Best practices for SAR filing when dealing with multiple small-value transactions flagged by system

Been looking into how other fintech ops are handling a common scenario: our system flags a series of small-value transactions from what appears to be a single entity across various accounts, none individually hitting a SAR threshold, but collectively, they look suspicious. We've got our internal thresholds, but I'm curious about the industry's best practices for aggregating these and making the call for a SAR. Is it purely quantitative, or are there qualitative aspects that weigh more heavily for you folks? Any specific tools or methodologies that help streamline this process without creating a ton of false positives?