Background scan every 5 min opens rule:host_silence and notifies without waiting for the next ingest event. CLI job + optional systemd timer. Co-authored-by: Cursor <cursoragent@cursor.com>
- Threshold rules on ingest; heartbeat auto-resolves host silence - Config thresholds in sac-api.env; unit tests Co-authored-by: Cursor <cursoragent@cursor.com>