Isolate Server Before Investigating Unusual Outbound Traffic

Quick Answer

Isolating the server from the network is the correct first step because the situation described, a server that normally talks only to internal systems suddenly making outbound connections to an external IP on port 443, is a textbook sign of a command-and-control channel, and the immediate priority in incident response once a compromise is suspected is containment, not investigation or cleanup. Isolating the host achieves containment while preserving the system in its current running state, which matters because the server's memory, active processes, and other volatile evidence are still intact at this moment; anything that changes that state risks destroying evidence needed to understand what happened. This is precisely why shutting the server down or immediately running an antivirus scan would be the wrong first move: powering off wipes volatile memory where malware often resides only in RAM, and an AV scan can quarantine or delete files before they've been examined, both of which violate the order-of-volatility principle that governs evidence preservation. Isolation strikes the right balance, stopping the bleeding without destroying what the investigation still needs. When a scenario presents signs of active compromise and asks for the FIRST response step, default to the option that contains the threat while disturbing the system as little as possible, rather than options that shut down, remediate, or scan before containment has happened.