Answering your comment here since the comment space seems too small.
1) Every environment is different and I, or anyone else, can't tell how exactly should your situation be investigated. But the logs are all you need, you don't need to disturb the machines' work. I would start from looking at all the logs related to these hosts around the times of those DoS alerts (could start with 5 minutes and reduce if the number of log entries is unmanageable) to possibly get some context of the events. For example, was there any other suspicious traffic sent from the same source.
2) Devices, that are connected to the network, are most often available for malicious vulnerability scanning and external attack attempts. They don't need to be infected if malicious actors want to try to attack them. As long as they're patched for the said vulnerabilities though, it is fine.
I'm not sure if I understand your described infrastructure correctly but if the dropped traffic was internal it was most likely false positive. Or someone within your infrastructure tried to DoS your hosts (not impossible).