If you detect anomalous outbound traffic on a critical internal subnet, what are your immediate troubleshooting and containment steps?
