If you detect unusual outbound traffic from a manufacturing facility server, what are your first three steps?
