Walk me through the steps you would take to investigate an anomalous spike in outbound DNS traffic at NCR.