You receive an alert indicating potential lateral movement within the corporate network. What are your first three steps?