Every alert that fires is doing its job. That is the problem. The model is wrong, not the thresholds.