An endpoint alert could be a benign maintenance script. What should happen before declaring a confirmed incident?

1. Triage using context and supporting evidence
2. Assume every alert is harmless
3. Publish an accusation immediately
4. Delete the alert and related logs