How do you fine-tune security alerts to reduce false positives while still catching genuine anomalies?
