decision_gap_report
Compare active CrowdSec decisions against recent alerts to uncover gaps, repeated sources, expiring actions, and noisy scenarios requiring attention.
Instructions
Compare active CrowdSec decisions with recent alerts and return read-only attention findings.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| window | No | Lookback window such as 15m, 6h, 24h, 7d. | |
| repeat_threshold | No | Alert count threshold for repeated source IP findings. | |
| expiring_soon_hours | No | ||
| noisy_scenario_threshold | No | Alert count threshold for noisy scenario findings. |