What should be the FIRST action for a security administrator who detects an intrusion on the network based on precursors and other indicators?

Isolating and containing the intrusion is the first action because it limits the attacker's ability to cause further damage, exfiltrate data, or move laterally within the network. According to incident response frameworks like NIST SP 800-61, containment is the critical first operational step once an incident is confirmed, stopping the bleeding before investigation or notification occurs. Delaying containment while performing other steps allows the threat actor more time to compromise additional systems.

Notifying system and application owners is an important step but occurs after containment, as alerting stakeholders before isolating the threat does not stop the active intrusion from spreading.

Applying OS patches is a remediation and hardening activity that occurs much later in the incident response lifecycle, after the intrusion has been contained, eradicated, and the root cause identified.

Documenting and verifying the intrusion is part of the identification and post-incident analysis phases, but acting on containment takes precedence over documentation when an active intrusion is in progress.