An alert indicates that multiple internal endpoints are communicating with a known malicious IP address, and the analyst needs to identify the scope of this activity by using Log Viewer.
What is the first step in identifying which internal hosts have communicated with the malicious IP address and determining the extent of the communication?