How do you recommend containing an intrusion?

I'm leaning towards containing an intrusion by reconfiguring the switch to put it in a VLAN with restricted access, and if possible mirroring the switch port so another host could collect network traffic. However, I'm curious as to what the experts do.

What method of containment do you utilize when responding to an intrusion and why? If you chose other, please specify here.