It happens; as someone who investigates these kinds of alerts, I apologize. 😅
In general, the systems that detect a lot of this activity are far from perfect or exact, and without manual review it's difficult to tell legitimate activity from that which is actually malicious.