I agree with you that our alert structure needs some TLC.
Whether aws's structure is the right thing to use is up for exploration/research. My thoughts were to further categorize the events according to the veris tags, and instead of having to drag/drop veris tags in an investigation/incident, import an alert with the respective tags already in the structure which would automatically populate investigations/incidents with them.

I'd like to see categories from veris rather than the source of the event, source of the event can be populated elsewhere. I'd like to see possible attack vector, links to documented indicators, possibly affected attributes and assets, etc. All of that should be taken into account and scored, the severity of the event would then be a direct result of that score.