From Alert-Based Monitoring to Intelligence-Led Investigation