A monitoring tool flags unusual transfers from a critical server, but compromise is unconfirmed. What should the incident manager prioritize first?

1. Validate and triage the event using available evidence and the incident criteria
2. Immediately announce a confirmed breach publicly
3. Rebuild the server before collecting any evidence
4. Wait for the annual audit