A SOC lead wants to reduce the time analysts spend deciding which of thousands of daily alerts to investigate first. The team has years of historical incident data indicating which alerts previously led to confirmed incidents, along with contextual features (asset criticality, user role, time of day). Management asks the lead to recommend an AI-powered analytic technique that will automatically rank incoming alerts by their likelihood of being a genuine incident. Which technique best meets this need?