What kind of user training should be conducted to deal with the issue of noise. How do you strike a balance between being overwhelmed with false positives and the danger of ignoring true incidents?