An EDR platform triggers a high-severity alert indicating that a workstation is beaconing to a known command-and-control server. The SOC analyst wants to prevent the potentially compromised host from spreading laterally or exfiltrating data while preserving it for investigation. Which automated alert response action should the analyst take FIRST?