I told them I’d first try to figure out if the alert is real or just a false positive. So I’d check logs, maybe compare the behavior to a baseline, and look for any signs that something suspicious is actually happening — like weird logins or traffic going to an unknown IP.