When investigating ITDR signals, take into consideration if the signin ip-address belongs to a EDR managed device.