... or is this overkill plus a huge waste of time

The fully depends on how well you know your own infrastructure, how good your monitoring is for attack detection and what proactive mitigations like very restrictive outbound access you had in place which might have stopped the attack.

If you were basically blind and had no mitigations in place then this might not be overkill. It might even be too little since the attacker might have used the the exploit not only to compromise this specific system but use the gained access to the internal network to compromise even more services and systems which are not directly accessible from the outside.

... or is this overkill plus a huge waste of time

The fully depends on how well you know your own infrastructure, how good your monitoring is for attack detection and what proactive mitigations you had in place which might have stopped the attack or limited the impact (like lateral movement, privilege escalation). For example restrictive outbound access could have stopped the downloading of the attack payload from an outside server, which was needed to actually exploit the issue.

If you were basically blind and had no mitigations in place then this might not be overkill. It might even be too little since the attacker might have used the the exploit not only to compromise this specific system but use the gained access to the internal network to compromise even more services and systems which are not directly accessible from the outside.

... or is this overkill plus a huge waste of time

The fully depends on how well you know your own infrastructure, how good your monitoring is and what proactive mitigations like very restrictive outbound access you had in place which might have stopped the attack.

If you were basically blind and had no mitigations in place then this might not be overkill. It might even be too little since the attacker might have used the the exploit not only to compromise this specific system but use the gained access to the internal network to compromise even more services and systems which are not directly accessible from the outside.

... or is this overkill plus a huge waste of time

The fully depends on how well you know your own infrastructure, how good your monitoring is for attack detection and what proactive mitigations like very restrictive outbound access you had in place which might have stopped the attack.

If you were basically blind and had no mitigations in place then this might not be overkill. It might even be too little since the attacker might have used the the exploit not only to compromise this specific system but use the gained access to the internal network to compromise even more services and systems which are not directly accessible from the outside.