A newly deployed SIEM is generating over 4,000 alerts per day, and the security operations center (SOC) analysts report that fewer than 2% of these alerts represent genuine security events. Analysts have begun ignoring entire categories of alerts, and a recent phishing-driven compromise was missed because the relevant alert was buried in noise. As the SOC manager, what is the MOST effective action to address the root cause of this problem?