Every alert should be actionable. Tuning thresholds trades missed detections against noise, and the right point depends on how costly each is.