A SOC analyst receives a case involving a suspicious email that reached three users. The email contains a Word document attachment with a macro. Company policy requires that any analysis actions must preserve the ability to attribute the incident and avoid tipping off the attacker. Which action should the analyst take FIRST when investigating this phishing case?