True, "check" was poor phrasing, because these things don't produce evidence, they produce alerts to guide investigation.

It should be a given that these systems don't produce anything actionable, they are a guide for a user to look more closely, of course, that requires someone in the chain stops and says "this isn't usable evidence".