When a raid hits

In the first minute

1. Turn on under attack mode: /underattack on or the switch on the dashboard. Every module acts, new members reach each risk level sooner, invites pause and the verification level goes up.
2. If the raid is posting, run /lockdown. If it's only joining, /lock add joins removes everyone who joins until you lift it.

While it's going on

• Watch the raid incident in the alert channel or on the dashboard. It lists every flagged member as they join.
• /incident ban-all bans everyone it flagged in one go, once you're sure.

Afterwards

1. /unlock and /lock remove joins, then /underattack off. Astri puts back what it changed.
2. Check Quarantine for anyone caught by mistake and release them.
3. Look at /invites: delete the invite the raid came through.
4. Close the incident, or mark it a false positive so you can tune your settings.