Your SOC receives 8,000 alerts per day, and analysts are burning out. Leadership approves an AI correlation engine to triage alerts before they reach analysts. What should the SOC manager establish FIRST?
A. Thresholds for how many alerts the AI can auto-close without human review
B. A tuning schedule to retrain the model quarterly on new threat data
C. A validation baseline comparing AI triage decisions against analyst decisions
D. Dashboards showing analyst time saved by the AI correlation engine