RAILWAY Run Book

Modified on Tue, 11 Nov, 2025 at 4:49 PM


GENERAL INFORMATION

Item

Content

Client Name

Catholic Charities of Baltimore

Client Alias

RAILWAY

Contract Start

May 20, 2025

Contract End

May 19, 2026

Billing Address

320 Cathedral Street Baltimore, MD 21201

Physical Address 1

320 Cathedral Street Baltimore, MD 21201

Website

https://cc-md.org

Primary Phone

# Main line for reaching the client. Example: "1-800-555-0199"

Time Zone

EST

Other


 

POINTS OF CONTACT / ESCALATION 

For incident escalations please email (and then if no response, text/ call) all primary contacts below.
If there is still no answer, then escalate to the secondary contacts (email/ phone/ text) until receipt is confirmed.
Reminder: All emails should be send by soc-support@lokilabs.io (not personal emails)


Send Railway Monthly Status Reports to both primary, secondary, and executive contacts listed below

Escalation Point

Name

Role / Position

Phone

Email

Notes

Primary

IT Service DeskSupport
844.323.5477
support@cc-md.org

Primary

Alan Mercer

Technical Architect and Information Security Consultant 

667.354.5746

 amercer@cc-md.org

 

Primary

Andrea Moore

 IT Analyst 

 -

 AMoore@cc-md.org

 

Primary

William Lohnes

 Director, IT Security & Technology 

410.960.5595

 wlohnes@cc-md.org

 

PrimaryKen BartelSystems Administrator
667-600-2266
KBartel@cc-md.org

Secondary

Paul Melian

 Director, IT Operat

667.600.2268

 pmelian@cc-md.org

 

Executive 

Jane Terry

 Exec Director

 -

 jterry@cc-md.org

 

 

SCOPE OF SERVICES

Service

Supported

EDR (CrowdStrike)

Managed by Loki Labs

XDR (Wazuh) - Endpoints

Endpoint telemetry monitored via Wazuh.

Annual Vulnerability Scan

yes

Advisory Services2 hour, bi-weekly sessions



SPECIAL INSTRUCTIONS

Activity

Description

Patching Windows


Maintenance Windows


Exceptions to Monitoring

-If OneLauncher is detected, the SOC is authorized to immediately quarantine the system. The client will be notified following quarantine. 

-OneStart, OneStartUpdater, PDFSKILLS, WaveBrowser, ZoomInfoContactContributor, AceLauncher,SparkOnSoft should be blocked by hash or filename, if found should be removed and client notified. IOA and IOC rules are created in Crowd Strike for all. If a detection for one of theses files come create a IOC for the hash and notify custoer,

Critical Systems to Monitor

See Critical Systems Attachment

Other


 

 



SECURITY TOOLS & AGENTS

Tool / Agent

Function

Hosted By

Notes

CrowdStrike Falcon

EDR

Loki 

 

Wazuh Agent

XDR

Loki

 

Mimecast
PhishingClient

not supported by Loki

KnowBe4

Phishing

Client

not supported by Loki

Ivanti

Endpoint Mgmt., Patch Mgmt., ITSM, Asset Discovery

Client

not supported by Loki

-

 

 

 

 

 

 

 

 

 

 

 



ASSET INVENTORY

Hostname

Device Type

OS

Owner

Notes
















-

 

 

 

 

-

 

 

 

 

-

 

 

 

 

-

 

 

 

 

-

 

 

 

 

-

 

 

 

 

-

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 



ADDITIONAL NOTES

Additional Notes

 -When notifying client first Voice Call to Catholic Charities Support Desk - 1-844-323-5477 then
Follow up email to support@cc-md.org and CC Willian Lohns, Aadrea Moore, and Ken Bartel Cc:wlohnes@cc-md.org, amoore@cc-md.org, kbartel@cc-md.org



UPDATE HISTORY

Instructions: Track who updated the runbook, when, and what was changed. Keeps audit history clean.

Date

Updated By

Changes Made

Notes

2025-07-24

Bryan Anderson

Document Created

 

-

 

 

 

-

 

 

 

-

 

 

 




Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article