If you see a sudden spike in outbound DNS traffic from a restricted subnet, what are your immediate next steps?
