A security analyst is reviewing the logs from a NGFWs automated correlation engine and sees the following:

Match time	Object name	Source address	Summary
2019-07-23 10:14:33	Possible beacon Detection	10.202.10.89	Host is generating unknown TCP or UDP network traffic
2019-07-23 10:14:52	Possible beacon detection	10.202.88.88	Host is generating unknown TCP or UDP network traffic
2019-07-23 10:19:12	Potential C2 communication detected	10.202.55.3	Host repeatedly visited malware domains (100)
2019-07-23 10:21:21	Compromised asset	10.202.100.12	Host is compromised based on a sequence of recent threat log activity
2019-07-23 10:30:37	Possible beacon detection	10.202.123.99	Host is generating unknow TCP or UDP network
2019-07-23 10:32:03	Possible beacon detection	10.202.44.107	Host visited known malware URL (15)

Which of the following should be analyst perform FIRST?

1. Isolate the compromised host from the network
2. Clear the logs and see if the same events reoccur
3. Set up an alert to receive an email notification for all events
4. Refresh the URL filtering database to ensure accuracy
5. Set up a packet capture to analyze the unknown TCP and UDP traffic