An IT security engineer notices that the company's web server is currently being hacked. What should the engineer do next?

Unplugging the network connection immediately stops the attack but destroys volatile evidence like active session data and may constitute an unauthorized decision to take a system offline without proper authorization.

Launching a counterattack is illegal under computer fraud laws in most jurisdictions and violates standard incident response policy.

Recording as much information as possible during an active attack preserves volatile forensic evidence such as active connections, memory contents, and attacker IP addresses that would be lost if the system were restarted or disconnected. This data is critical for post-incident analysis, legal proceedings, and identifying the attacker's techniques. Evidence collection is a core step in incident response before containment actions are taken.

Performing a system restart terminates active connections and clears volatile memory, destroying critical forensic evidence before it can be captured.