Can you explain a specific instance where you reduced false positives in SIEM alerts, and what methods you used to achieve this?