While talking to an associate, they ask you to describe how different alerts in IntroSpect indicate compromise on the network. Would this be a correct statement? (If an entity executes a large download followed a few days later by a large upload to DropBox, this could be an indication that the entity is compromised.)