Whenever you're ready, walk me through how you'd approach this.
Tell me about how you would investigate a security alert and determine whether it is a real incident or a false positive.
