Q8
Single choice
A SOC analyst notices repeated failed login attempts from a foreign IP address followed by a successful login to a privileged account.
What is the most appropriate next step?