Sarah, a security analyst at TechCorp, receives an urgent notification on her phone. She opens the Microsoft Defender for Cloud Apps portal and sees a high-priority alert. The alert indicates that a user, John, has logged in from New York and London within a 2-hour timespan. Sarah knows she needs to act quickly. What should be Sarah's first step in responding to this alert?