To emulate often limited information and collection abilities early in an incident, before doing ANY other basic troubleshooting we're going to launch Wireshark to inspect the network. Start somewhere you can!
"But SSH is encrypted."
Troubleshooting is often connecting metadata.