You receive an alert for unusual outbound traffic from a production database at Chime. What are your first three steps?