A security analyst at a mid-sized firm notices an unusual spike in outbound network traffic from an internal database server late at night. She reviews the SIEM alerts, correlates the logs, and confirms that the traffic matches known data-exfiltration patterns. She has not yet isolated the server or removed any malware. According to the incident response process, which phase is the analyst currently performing?