Category using siem edr investigation