WGU D483 DJN2: Incident Response
Reporting Template & Lessons Learned
Update with complete solutions.
SECTION A: INCIDENT DETAILS
Incident number(s): HDE- 1001, 1050, and 1072
Incident date(s): 13 December
Report author:
Report date: 7 July 2025
Summary of incident: The incident occurred when multipe engineers at Design by
Paradignm experienced server performance issues with
their Pro-Engineer CAD application. Multiple users stated
the application became slow and unresponsive, resulting in
them contacting the helpdesk for further investigation.
The Operatoins team identified that the fileserver was
experiencing high utlization and following SOP, rebooted
the server.
After this, additional tickets were created after users
started to experience latency on their devices.
After further investigation of our SIEM too, I believe an
unvereived update from an undetermined source was
applied to the server which resulted in the increseasd
utlizatoin on the GUP and CPU. Furthermore, there are
multiple remote connections established with the server to
unown IP addresses.
Impacted system(s): WIN-6JNN6RLT6IL
Primary function of the File storage for Pro-Engineer
impacted system(s):
Impacted user(s): Maya Patel, Diego Martin, Alex Lee
_
, Incident timeline: • 13 Dec 10:00 AM: first incident was repoted (HDE-
1001)
o Shortly after this ticket, operations quickly
identified the storage server expercing high
utilization and began remdation efforts
immediately. It was unscessfull. Followed
SOP
• 13 Dec 03:14 PM: 2nd incident reported (HDE-1050)
• 13 Dec 03:20 PM: 3rd incident reported (HDE-1072)
_
Reporting Template & Lessons Learned
Update with complete solutions.
SECTION A: INCIDENT DETAILS
Incident number(s): HDE- 1001, 1050, and 1072
Incident date(s): 13 December
Report author:
Report date: 7 July 2025
Summary of incident: The incident occurred when multipe engineers at Design by
Paradignm experienced server performance issues with
their Pro-Engineer CAD application. Multiple users stated
the application became slow and unresponsive, resulting in
them contacting the helpdesk for further investigation.
The Operatoins team identified that the fileserver was
experiencing high utlization and following SOP, rebooted
the server.
After this, additional tickets were created after users
started to experience latency on their devices.
After further investigation of our SIEM too, I believe an
unvereived update from an undetermined source was
applied to the server which resulted in the increseasd
utlizatoin on the GUP and CPU. Furthermore, there are
multiple remote connections established with the server to
unown IP addresses.
Impacted system(s): WIN-6JNN6RLT6IL
Primary function of the File storage for Pro-Engineer
impacted system(s):
Impacted user(s): Maya Patel, Diego Martin, Alex Lee
_
, Incident timeline: • 13 Dec 10:00 AM: first incident was repoted (HDE-
1001)
o Shortly after this ticket, operations quickly
identified the storage server expercing high
utilization and began remdation efforts
immediately. It was unscessfull. Followed
SOP
• 13 Dec 03:14 PM: 2nd incident reported (HDE-1050)
• 13 Dec 03:20 PM: 3rd incident reported (HDE-1072)
_
