A blue-team engineering project improved alert quality and reduced investigation ambiguity for high-risk techniques.