When responding to an network$-$based alert involving an IDS signature originating from an internal web server, these devices should be considered in scope for the investigation