23,000 alerts triaged in 2 years

I just hit 23,000 triage in 2 years and I've only come across 11 TPs (there have been many virus alerts and ddos but never actually compromising anything due to EDR and WAF) of those TPs 8 were phishing compromises via credentials theft, two were insider threat and one was full DC compromise.

My point is I'm assuming this is not normal haha?