You receive an alert indicating unusual outbound traffic from a critical substation network at National Grid. What are your first three steps?
