During an active incident response, your team has identified a breach within one of the company's critical servers. After initiating the containment phase, what is the next key action to perform to accurately define the scope of the incident?
Analyze the extent of the compromise to understand the full impact across the network.
Start re-imaging all compromised systems to ensure no remnants of the breach remain.
Immediately reset all user credentials within the organization to preclude further unauthorized access.
Initiate a digital forensics analysis on the directly affected server.