DRAG DROP Refer to the exhibit. 
The Cisco Secure Network Analytics (Stealthwatch) console alerted with “New Malware Server Discovered” and the IOC indicates communication from an end-user desktop to a Zeus C&C Server. Drag and drop the actions that the analyst should take from the left into the order on the right to investigate and remediate this IOC. 
Yeah, for incidents like this Stealthwatch alert, you really want to do the search and investigation steps before jumping into containment. So it's: Search for infected hosts → Investigate infected hosts → Investigate and classify the exposure → Examine returned results → Execute rapid threat containment. Makes sense given you need to know what you're dealing with first. If anyone has seen a scenario where you'd contain right away, let me know.
