Real alerts fired by my Wazuh manager, worked the way I'd triage them on a SOC floor: what fired, what I checked first, what would confirm or rule out a false positive, and the final verdict — mapped to MITRE ATT&CK where relevant.