Watch this video on YouTube
During the identification phase of an incident response, what is the first action to take after detecting an anomaly?