AML Red Flags and Transaction Monitoring Alerts - Where's the Line?

Hey everyone, fairly new to the compliance side of things and trying to get my head around AML a bit more deeply. We're running a pretty standard transaction monitoring system, and I'm finding myself constantly debating where to set the thresholds for alerts. I understand the concept of 'red flags' and unusual activity, but it often feels subjective. For example, a client making a series of deposits just under our reporting threshold, or frequent international transfers to a high-risk jurisdiction. On paper, these are alerts, but how do you guys really differentiate between a genuinely suspicious pattern that warrants a deeper dive (and potentially an SAR) versus just a noisy alert from a client with genuinely complex but legitimate financial activity? It feels like there's a fine line between being thorough and just drowning in false positives. How do you approach that balance in practice without missing the real risks?