An endpoint is actively exfiltrating data. Responders have authority to contain it while preserving evidence where feasible. Which approach best fits?

1. Revoke the compromised access path and investigate related activity.
2. Use approved artifact analysis and threat-intelligence services.
3. Correlate identities, artifacts, timelines, and affected resources across available evidence.
4. Isolate the affected endpoint using the approved containment procedure.