The recommended first response steps for network defenders typically include preserving the state of the suspected devices and extracting relevant data as early as possible. Disabling virus protection is not part of the recommended first response steps because it could compromise the system's security further and potentially destroy evidence. The primary goal in the initial response is to maintain the integrity of the system and the evidence it contains.