During an active incident response, your team has identified a breach within one of the company's critical servers. After initiating the containment phase, what is the next key action to perform to accurately define the scope of the incident?
Immediately reset all user credentials within the organization to preclude further unauthorized access.
Analyze the extent of the compromise to understand the full impact across the network.
Initiate a digital forensics analysis on the directly affected server.
Start re-imaging all compromised systems to ensure no remnants of the breach remain.