In October 2024, a city utility reviews a security ticket: DNS queries from a laptop resolve newly created command-and-control domains minutes before beaconing starts. billing staff are preparing quarterly reports, and PAN-OS 11.1 logs are available. Which control is most direct?