That's a really insightful analysis of network monitoring, especially the part about firewall. The internal identified 001 instances of misconfiguration that need to be addressed.

The attacker attempted to credential harvesting but our security tools successfully prevented it. We'll be conducting a tabletop exercise to simulate this phishing scenario next holiday...

The Blue Team recommends implementing security tools to prevent similar ransomware in the future. The Red Team recommends implementing security controls to prevent similar phishing in the future....