Reduce alert fatigue when only one in five alerts is real

An anomaly detection service sends about 300 alerts a day to a team of three analysts. Sampling 60 alerts shows 12 are real. Analysts have started ignoring the channel, and last week a real incident waited two days.

Diagnose the situation and propose a plan with concrete steps, numbers you would track, and the trade-offs you are accepting.