While investigating alerts in the Analyzer you notice a host desktop with a low risk score has been sending
regular emails from an internal account to the same external account. Upon investigation you see that the
emails all have attachments. Would this be correct assessment of the situation? (Your next step should be
to find what user account logs into this desktop, and look at activity of their devices this user has access
to.)