A network administrator is troubleshooting a recent spike in endpoint security alerts within a corporate environment that utilizes Cisco FireAMP for endpoint protection. The alerts indicate a significant number of potential malware detections across various endpoints. After reviewing the logs, the administrator notices that the alerts are primarily coming from a specific department that frequently downloads large files from external sources. What should the administrator prioritize in their troubleshooting process to effectively mitigate the risk of malware infections in this scenario?