Six months after deploying a SIEM, the incident response team reports that analysts are ignoring most alerts because the vast majority turn out to be benign, and a recent malware infection went unnoticed for two weeks despite generating log entries. Which action should the information security manager prioritize to improve incident detection effectiveness?