After a far-reaching cyber attack on an internationally active company, the ability to work was severely limited. With varying degrees of impact on all infrastructure components, it must be assumed that peripheral devices, clients and the core infrastructure were compromised. A Security Operation Center can be a powerful tool to restore visibility across the infrastructure and to detect and react to expected second-round attacks in time to prevent further incidents.