The question uses the word "suspected." In CISM-speak, "suspected" means you are still in the Identification/Analysis phase, not yet in the Containment or Eradication phases.
Before you take any disruptive action (like shutting down a revenue-generating e-commerce site), you must confirm that an incident is actually occurring. You cannot respond to a ghost.
Reviewing the access logs is the most immediate way to validate the suspicion. It allows you to see if the access was indeed unauthorized, identify the source, and understand the scope without crashing the business process.
In an e-commerce environment, "Isolating assets" or "Revoking access" causes immediate downtime and loss of revenue. A Manager does not pull the plug until the threat is verified.