In a similar way to the problem I mentioned above, but not quite the same (since these are not ephemeral workloads, at least that's my understanding) we are observing this in prod : Even when an allow rule is made, we are still receiving alerts. Even if I click the "review rule" in the UI to add an allow rule based on the event, it still keeps popping up. We're even to the point where we have seemingly identical rules defined multiple times since we keep trying to re-add them... I'm asking here before opening another issue just to be sure I'm not missing something obvious. Thanks! @quaint-candle-18606 ping to get your opinion when you have some time. Thanks a lot!