fix oref alert detection