https://www.elastic.co/blog/false-positives-automated-siem-investigations-elastic-tines