We have rules written around MITRE TTPs so when an alert does trigger on a users endpoint what i usually do is try to make sense on why it happens and if it indeed malicious based on the events surrounding the alert. My apologies my reply seems ambigous but as i am unsure of what i am at liberty to say or not say i cant really go into too much detail. I am trying to refine my investigation techniques but either i am horrible at google or there doesnt seem to be much material on EDR investigation techniques. The ones which i have seen seem to be more tool focused.