One of my biggest pet peeves during the investigation process is hearing these words: “Did you ask the user?” In my Think Like An Analyst Series, I go over several ways to help come to a conclusion for an alert. I talk about slowing down, asking questions, changing perspectives, and comparing data. The one thing…