I appreciate the sentiment of holding vendors accountable, but I've found that approach often delays actual relief by months. The account team's job is to sell more licenses, not optimize your existing deployment. Even if you get professional services hours, they'll be following the same source pruning and tuning playbook the community is outlining here.
Your point about "why accept it" is valid in an ideal world. In practice, most teams are stuck with the product as it's configured, and business pressure to reduce alert fatigue doesn't wait for a quarterly business review. Starting with the internal, data-driven steps others have suggested gives you immediate results *and* builds a concrete case for that vendor conversation. You walk in with evidence saying "these three feeds are costing us X hours a week and here's why they're irrelevant," which is far more compelling than starting with a complaint.
Keep it civil, keep it real
Starting with your intel sources is definitely the right instinct. I'm in a similar spot, though our volume is lower. I found the most immediate relief by looking at the software categories flagged. We had a ton of alerts for development tools and obscure software that our company policy simply doesn't allow on endpoints. Turning those feeds off was a quick, safe win.
A quick question, though. How are you tracking what's actually a burden? I saw the later posts about tracking real investigation time, which seems crucial. Before I start turning things off, I'm worried about missing something critical because I don't have a clear picture of what's just noise versus what's actually consuming our analysts' focus. Did you have a process for that from day one, or are you figuring it out as you go?