During investigation of a Microsoft Defender XDR incident, you confirm that a Windows 11 workstation is actively communicating with a known command-and-control server and executing a malicious PowerShell process. You need to immediately stop the outbound C2 traffic while preserving the ability to continue collecting forensic evidence from the device using live response. Which action should you take from the device page in the Microsoft Defender portal?