What techniques did you find most effective for triaging alerts in SIEM tools like Splunk?

Technical