Please provide when did it start, do you have endpoint security sensors deployed to all endpoints (Laptops,desktops, servers to include virtual servers), do you have an IT or security point of contact on site to coordinate with? Feel free to provide any other information that might help with a quick response.