Hi,
I wouldn't recommend to focus on the single finding. Indicator-of-compromise category contains rules that should be used for the detection of a positively compromised system and false positives may occur.
When evaluating an event, all the intrus...