Thanks, you confirmed what we suspected 
This is our first SG entry and we read rule “Make sure your team has one, and only one entry, in the system” too literally.
Our Security Investigation event already have several files. May be even more than need in this event.
about two pals and primary:
event states -
primary distibute gifts, secondaries receives gifts;
someone “have two secret pals”, hence he should prepare two gifts, hence he is primary
btw, about ? and % aliases rule says “Avoid aliases, except for –Object cmdlets”.