A security analyst at a logistics company notices unusual outbound traffic from an internal file server late at night. She suspects malware is exfiltrating data. According to a typical incident response plan, which activity should the incident response team prioritize immediately after the incident is detected and confirmed?