A SOC analyst reviews an IDS alert that fired for outbound traffic to a known malicious IP. After investigating the endpoint, the analyst confirms the host is running a trojan that was beaconing to the flagged IP. How should this alert be classified?