fix

internal/alerts/runner.go

@@ -198,7 +198,21 @@ func (r *Runner) Tick(ctx context.Context, now time.Time) {
 // DetectAlerts is the detection half of a tick: spikes reduced to actionable
 // patterns. Exported so the CLI and the runner cannot drift apart.
 func DetectAlerts(events []features.Event, at time.Time, cfg features.SpikeConfig) []features.Spike {
-	return FilterActionable(features.DetectSpikes(events, at, cfg), false, nil)
+	// Scanners, route enumerators and crawlers getting 4xx are noise for paging.
+	features.MarkBadActors(events, features.BadActorConfig{})
+	minExcess := cfg.MinExcess
+	if minExcess <= 0 {
+		minExcess = features.DefaultSpikeConfig().MinExcess
+	}
+	var out []features.Spike
+	// The excess threshold is applied after triage: a service whose total
+	// excess is mostly probes must not page on the little that is left.
+	for _, sp := range FilterActionable(features.DetectSpikes(events, at, cfg), false, nil) {
+		if sp.Excess >= float64(minExcess) {
+			out = append(out, sp)
+		}
+	}
+	return out
 }
 
 func (r *Runner) deliver(ctx context.Context, a Alert) {