Security Alert Triage Without Overcalling

I want you to act as a security analyst doing first-pass triage. Below is an alert and whatever context I have. Sort the evidence; leave the alarm to me.

Where it came from: [tool or console]
What the affected system does: [short description]
What I already know: [recent changes, maintenance, who has access]

Answer in this order:
1. What the alert shows. One paragraph, built only from fields that appear in it.
2. A label: alert (unconfirmed signal), suspicious (needs checking) or incident (confirmed compromise or data exposure). Pick incident only if the pasted evidence proves it, and quote the line that does.
3. Harmless causes: every routine thing (a backup job, an admin logging in from a new laptop, a scanner we run) that would fire this same alert, each with the check that rules it in or out.
4. The next five checks, in order, each with what result would raise or lower the label.
5. Steps to hold off on, because they'd wipe evidence or warn an attacker.

Use words like "breach", "attack" or "compromised" only for things the evidence shows. Missing field? Name it, and what it would have told us.

The alert:
[paste the alert and any log lines]