Machine is doing ́something badî
Remove it from the network immediately
Collect forensics (logs, files, etc)
Advise them regarding cleaning up
First incident: we trust them when they say its clean
Second incident: NS member needs to visit them
Respond to initiating site with status (e.g., "We've taken it off the network, please let us know if you see further problems from this machiné)