Learn · 1/2

Isolate and communicate

If suspicious, limit the affected account/system, notify IT/security, and do not destroy evidence.