When first analyzing an intrusion that has just been detected and confirming that it is a true positive, which of the following actions should be done as a firs...