How to react in this Ransomware scenarios? Best practices?

very new to cybersecurity and learning a bit more in this field trying.

Pretend Scenarios

* PC infected with Ransomware but microsoft defender picked it up and set the pc to isolation
* Would you completely toss out the PC?
* Or a re-image would be fine?
* What about the staff's data?
* if defender did a false positive for the ransomware what actions should be taken?

What tools is good for first responders level 1 techs?

​

​

best practices cybersecurity defender image isolation microsoft microsoft defender practices ransomware react