From alert fatigue to action: Smarter SOC workflows for defence teams