There is always some fallout, but over the past two weeks the ratio was
never above 0.0001. It did go up to 0.0004 when there was an issue with
email delivery, so 0.0002 seems to be a decent value to trigger an
investigation.
The previous version of these rules was incorrectly testing for >5
events per second, which isn't the desired behavior. By measuring the
delta, we determine if the number of events is >5 over a 10 minute
period.
Conrad Hoffmann