A. Not an urgent action: Use IVP to confirm if machine is infected.

B. Immediate response required: Block malware IP addresses (download server or CnC server)

C. Immediate response required: Deploy IVP integration (if configured) to confirm if the endpoint has executed the malware and is infected.

D. Immediate response required: Wipe infected endpoint hosts.