When you get one alert that you realize isn't false and has the forensic data tied to it, you can use it as a harness against the loads of information from all

When you get one alert that you realize isn't false and has the forensic data tied to it, you can use it as a harness against the loads of information from all the other sensors (firewall, endpoints, sandboxes etc) to give you a definitive picture you're certain in.