Do you have Airwave?
Most of the process for us has been about identifying what triggers we want to alert someone about starting in severity with rogues and working down to more common events. Have you gone through the RAPIDS best practices guide? It is available on your AMP in the documentation page.
If you dont have AMP, tweak you classification rules to make sure your events are relevant.