What would you do if you noticed unusual activity in the network logs?

Situational