Sampling alert files without chasing every false positive
You will not read every alert. Trying to is how audits stall.
Stratify by severity, product line, and age. Pull closed and open cases. For each stratum, ask three questions: Was the right rule supposed to fire? Did the analyst follow the playbook? Is the documentation reconstructable by someone who was not in the room?
Patterns across thirty well-chosen files usually say more than anecdotes from three hundred random ones. Document the sample design — reviewers care about method as much as findings.