One server has been compromised, and the provider wants it handled immediately.
The message arrived in the middle of other consulting work. I called the provider, took the affected machine offline, and started reprovisioning it.
Then I sent a short confirmation. The server is no longer reachable. It is being reprovisioned. If the provider sees another complaint or needs anything else, they can contact me directly.
That removes the reported server from the network. It does not answer the bigger question.
If one box has been compromised, I cannot assume every other machine is fine because it has not generated a complaint yet. I need to run rootkit checks across the rest of the environment and look for anything else that does not belong.
The mail-server work moves down the list again.
The provider needs a short operational answer: the reported system is offline, reprovisioning has started, and I am available directly if another report arrives.
That is what I sent back. I did not report the rebuild as finished or say the other machines were clean. I confirmed only the action already underway on the named server.
My remaining list is still open. Finish reprovisioning the affected server. Run the rootkit checks on the other systems. Review anything the checks find. Then return to the mail-server work that has been delayed.
I have contained the one machine named in the report. I have not yet cleared the rest of the environment. Those checks come next.
That work remains unfinished today.