A person answers, not a queue. Call, message, or send the form: the guard on your servers goes into Under Attack Mode, a specialist calls you back, and we stay on it until traffic is back to normal.
A specialist calls back, gathers what your servers and the guard have seen, and confirms which attack vectors are in scope: flood, web exploit, credential attack, malware, insider.
Under Attack Mode on your guard: blocking at medium severity, containment at an hour, halved flood thresholds, a browser challenge in front of the WAF, country blocks where they help. Playbooks for the rest.
We watch until traffic is back to normal, walk back the emergency settings, write up what happened and what to change, and keep the case open until you say it is over.