A data manipulation detection device that includes an alert engine configured to receive data from a data source, apply a set of rules for a threat model to the data using a first machine learning model, and to obtain an alert vector in response to applying the set of rules to the data. The device further includes an alert feedback engine configured to receive alert feedback that includes text comments for the alert vector. The device further includes a natural language processing (NLP) training engine configured to identify the text comments for the alert status and identify keywords within the text comments associated with a rule parameter value for a rule. The NLP training engine is further configured to determine a new rule parameter value based on the identified keywords and modify a rule parameter value for the rule based on the new rule parameter value.