If steps 3 to 6 reveal that the alert warrants investigation, you can create an incident.
Example
The analyst creates an incident in order to perform an investigation.