Tag false-positive alerts in SOC