A security analyst opens the Incidents queue in the Microsoft Defender portal and sees an incident that groups together a suspicious sign-in alert from Microsoft Entra ID Protection, a malware detection from Defender for Endpoint, and a mass file-download alert from Defender for Cloud Apps — all tied to the same user. The analyst wants to contain the threat across all affected assets as quickly as possible while preserving the correlated context for investigation. What is the BEST first action to take?