How computers, operating systems, networks and the command line work.
Every alert you will ever open is a process touching a file, a port, or another process. If that layer is a blur, every line in the log looks equally suspicious and you escalate all of it. The analysts who move up are the ones who can say "that is just the updater" without opening a ticket.