The recommended first response steps for network defenders typically include preserving the state of the suspected devices and extracting relevant data as early as possible. Disabling virus protection is not part of the recommended first response steps because it could compromise the system's security further and potentially destroy evidence. The primary goal in the initial response is to maintain the integrity of the system and the evidence it contains.
References: This approach aligns with best practices for incident response, which emphasize the importance of not altering the state of a system during the initial investigation to avoid evidence tampering or loss12.