Investigation flow on the most normal alerts

Based on the 10 most normal alerts, a generic investigation flow should be created. It is a decision tree that cyber security analysts can use to better counteract a potential attack, and to investigate whether it is a real attack or a false positive.