An XDR platform generates an alert showing a PowerShell process spawning immediately after a Microsoft Word document opened. The PowerShell command is heavily obfuscated and connects to an external IP address.
What should be the analyst's highest priority initial action?
Delete the Word document from the endpoint.
Validate the alert by reviewing process lineage and command-line activity.
Ignore the alert if the antivirus did not trigger.
Reboot the endpoint immediately.