What is the first action a security analyst should take when beginning to review and prioritize alerts from Targeted Attack Protection (TAP)?