Inability to determine the user assigned to an IP address flagged in a malware alert on the firewall can hindered incident response. The playbook will help in identfying the user if it's mapped to an WIFI IP address block of your office or branch Location.