A friend thinks you can answer this question about Security Operations Center
Your SOC sees 8,000 alerts/day across SIEM and EDR. Analysts triage roughly 600 of them. The CISO asks how to improve coverage. What's the right first move?