A SOC manager notices that Tier 1 analysts spend hours each day manually enriching commodity malware alerts—looking up file hashes in threat intelligence feeds, checking reputation of source IPs, and quarantining affected endpoints. The volume of these low-complexity alerts is causing analyst burnout and delaying response to higher-priority incidents. Which approach would MOST effectively improve operational efficiency for these repetitive tasks?