Poor alerts hamper effective automation of threat detection