Create normalized sender addresses for threat hunters before triage

Your sender addresses use plus-aliasing, causing duplicate alerts and missed correlation. Analysts receive consolidated sender IDs to reduce duplicates and speed triage by the next shift.