False Alerts and How to Tune Them

I'm getting unexpected alerts

DNS cdn_reshuffle false positives

If your CDN rotates IP addresses frequently, Merlonix should detect this as cdn_reshuffle (benign). If you see false positives:

1. Check the alert detail — it shows the AI classification and confidence
2. If classified incorrectly, open a support ticket with the alert ID

SSL renewal false positives

Certificate renewals (same issuer, same SANs, same key) should not trigger alerts. Check whether your CA changed the intermediate certificate.

Adjust severity filters

Edit your alert channel's severity filter to only receive warning and critical if low-severity noise is too high.