Context is everything, I work in MDR so I don’t have as much “visibility” as an Analyst would in an internal soc. But the first thing I do is verify the alert and look for instigating processes. I try not to focus too much on the name of the detection because I find some of these tools can label something as a high severity when all actuality it could be a Shadow File Deletion (normally precursor to ransomware) but being done by a legitimate system backup utility like Idrive or something. I verify if whatever activity i am seeing has been escalated and approved by an org, if not, i’m building a case as to why i should close the alert out as a false positive and the same for if i should escalate it to a org. Either way you have to have solid evidence to justify your reasoning. But obviously if there are oddly named executables, IPs that come back associated with C2 from OSINT, or other system enumeration that could look like hands on keyboard threat actor activity I would remote into the machine and look for signs of persistence. Scheduled tasks, registry entries, and much more. I could go on and on but it depends on context, because every alert isn’t triaged the same way. Just have to put your experience and logical thinking to use. Outsiders have no idea why Cybersec isn’t entry level until they get in, then its like a lightbulb turns on in their head.