You receive an alert that a server is communicating with a known malicious IP address at NCR. What are your first three steps?
