ThorTeaches.com's internal network has been experiencing intermittent disruptions, and we suspect it may be due to a security breach. We need to find the root cause of these disruptions and take necessary measures to prevent future incidents. What is the first step in conducting an investigation into a cyber security incident?