Scenario 1:

You receive an alert in your alert channel: "Allowed Activity - Severity 4/High IDS/IPS Alerts - From Internal--192.168.60.67--Win32/ZBot"

Log sources available to you:

Palo Alto NGFW

WinEventLog:Security

OSSEC HIDS

Client email correspondence

Shift logs and investigation notes

Prior cases

Internet

With this information, please walk us through your investigation steps and how you might triage this alert.