> ...  or is this overkill plus a huge waste of time

The fully depends on how well you know your own infrastructure, how good your monitoring is for attack detection and what proactive mitigations like very restrictive outbound access you had in place which might have stopped the attack.

If you were basically blind and had no mitigations in place then this might not be overkill. It might even be too little since the attacker might have used the the exploit not only to compromise this specific system but use the gained access to the internal network to compromise even more services and systems which are not directly accessible from the outside.