Details.
Triage and handling of EDR alerts, including false-positive filtering, workstation isolation, account blocking, access revocation, remediation, return to service, root-cause analysis, incident reporting and coordination with backups and disaster recovery plans.