Record the basics
Write down the date, time, and time zone of the first observation. Describe the affected systems at a high level and the impact you can confirm. If the start time is unknown, say so. Separate observations from interpretations: an inability to sign in is an observation; the cause may still be unconfirmed.
Explain actions already taken
Maintain a timeline of actions, decisions, and authorisations. Include changes made by your internal team or support provider. Preserve relevant information according to your incident procedure. Do not run unfamiliar commands, delete evidence, or forward suspicious files because a general guide suggests doing so.
Provide a reliable contact
Name someone who can coordinate the discussion and provide a reply address. State your organisation and whether you are authorised to speak for it. If an incident team is already involved, explain the coordination route. Avoid sharing other people’s personal contact details without permission.
Send the minimum information
The Under attack page creates a draft in your email application. You review and send it; the website does not submit it or confirm receipt. No immediate response is guaranteed. If urgent action is required, follow your existing incident support arrangements.