If you see an alert for unexpected outbound traffic from a critical internal server at Duke Energy, what are your first three steps?
