You receive an alert for suspicious lateral movement originating from an engineering workstation. What are your first three steps?
