Imagine yourself as the sysadmin of a server which has been successfully hacked. You have just discovered the break-in, and the attacker seems to still be occupying the system.

What, in general terms, would normally be your first few actions on

discovering the break-in? Explain briefly why you would take these actions.