A SOC analyst notices a spike in outbound traffic to an unfamiliar external IP on a nonstandard port. What should they do FIRST?