A suspicious signal doesn't automatically mean something is malicious.
A file can have high entropy without being malware.
A DNS pattern can look unusual without necessarily being tunneling.
An alert can be worth investigating without being a confirmed incident.