What does HOK activity look like?

I'm pretty new in my job as a threat hunter. Whenever we see Hands On Keyboard activity, we escalate it to an IR. As a new guy in my job, something I'm still having trouble doing is determining whether the activity is HOK or just a high alert.

What sort of activity does realtime HOK look like, as opposed to something that happened historically? Any tips on this?

alert cybersecurity doing hands on high high alert hunter job keyboard sort threat