Category soc analyst alert investigation steps