The small security operations team for a major national airline was stretched thin and suffering from alert fatigue trying to keep up with cyberthreats. While they had a robust security stack, and consolidated events in their SIEM, the alerts lacked important context, resulting in time-consuming manual follow-up.