How to reduce alert overload in defence SOCs