Investigations begin with a trigger, such as a high-fidelity SIEM alert, a new threat intelligence indicator, or an anomaly detected during routine monitoring.