An IT security engineer notices that the company's web server is currently being hacked. What should the engineer do next?

Unplugging the network connection stops the attack but immediately destroys volatile evidence such as active network connections and memory-resident artifacts needed for forensic analysis.

Launching a counterattack is illegal in most jurisdictions without explicit legal authorization and is not a valid or ethical incident response action.

Recording detailed information during an active attack - such as attacker IP addresses, HTTP requests, payloads, and system behavior - preserves volatile forensic evidence critical for post-incident analysis, attribution, and potential legal proceedings. This aligns with NIST SP 800-61 incident response guidance, which emphasizes evidence preservation as a key step before containment. Actions like disconnecting the server or restarting it can destroy volatile memory contents and active connection data before they can be captured.

Performing a system restart clears RAM and terminates active processes, destroying volatile forensic evidence that cannot be recovered after the reboot.