What to do if a server is hacked? Will Red Hat assist with development of security rules and policies and root cause?

Issue

• There is reason to believe that my server was hacked
• The host started presenting abnormal behaviors
• Sudden jump in network bandwidth and/or traffic consumption
• Unknown allocated space on disks
• New users/groups created on the system with random names
• An unknown root SSH login happened
• An untrusted IP address was able to login into my system
• Someone keeps changing user passwords