A security analyst has discovered that an outbound SFTP process is occurring at the same time of day for
the past several days. At the time this was discovered, large amounts of business critical data were
delivered. The authentication for this process occurred using a service account with proper credentials.
The security analyst investigated the destination IP for this transfer and discovered that this new process is
not documented in the change management log. Which of the following would be the BEST course of
action for the analyst to take?