A workstation repeatedly connects to a known malicious domain. What is the best initial analyst action?

1. Validate the alert and follow the containment playbook
2. Publish the user's password for team troubleshooting
3. Assume encryption makes the connection harmless
4. Delete every log referencing the domain