One alert, before you escalate
An alert is a claim with a clock. Read five fields before you send it on. If one of them is missing, the next person cannot tell a real event from a noisy rule.
The title of the alert
Copy the title as the rule wrote it. A title is the behavior the author thought they were naming. It is not a verdict that the behavior happened, and it is not a name for the person who did it.
If you shorten the title in a chat message, keep the original next to the short version. The next reader should be able to find the same rule.
The user or the host
Write the account, the host, or both, exactly as the alert names them. "The network" and "a user" are not names. If the alert names neither, say that. An alert with no subject is not ready to escalate.
One alert is one subject. Do not add the rest of the subnet because the address looks close to something you remember.
The time
Write when the alert says the event happened, and the zone if the product shows one. A rule that looks over an hour is a different fact from a single timestamp. Say which one you have.
If two alerts share a host and the times do not agree, keep both times. Do not average them into a story.
What the rule was written to catch
Say the behavior in one sentence: a process name, a logon, a volume of failures, a field that must be present. "Malicious activity" is not a behavior. If you cannot say what the rule matches, you are escalating a label.
The detection workbench is where those rules are taught. The Sigma lab is where you see a rule hit the events it was built for, and miss the ones it was not. The log lab is one question asked of a sample log.
What would make it a false positive
Name the ordinary work that would look the same: a backup, an admin tool, a scanner you run on purpose, a test account. If you cannot name that case, you do not know the rule well enough to call the alert certain.
Then write the finding. What the alert claimed, who or what it named, and what you would change: tune the rule, or escalate with these five fields filled in. The findings page is the shape of that note.