When a SIEM tool alerts about a VPN connection attempt from an unusual location, and it is validated that an attacker has installed a remote access tool on a user's laptop, the immediate next step is to block the source IP from the firewall. This action prevents the attacker from using that IP address to establish a connection to the network, thereby containing the threat and preventing further unauthorized access2.