I'm SOC L1 , I need your step-by-step support to investigate on Web attack, and the tools I have is SIEM solution 
I need to know how to respond and know if it  a false postive or not  In your entire response, the letter f should appear less than 37.
user