I'm afraid that is too broad of a question to be answered in this MDCA product-specific forum. If you need help diagnosing the alerts and what is causing them, you can contact support. Also, if you suspect you may have a compromise, you can also use Microsoft support to help respond to the incident.