I have a system with 2 fingerprint monitors active. The fingerprints are copies of each other, and one monitor checks for matches while the other checks for deviations. They have the same detection threshold.
Frequently, the “match” fingerprint gives 2 match alerts (I have the monitors generate context items) a ~2 minutes apart for the same event. The length of the fingerprint is ~30 minutes and there are 3 tags involved.
Other times, the “match” fingerprint and the “deviation” fingerprint will both detect and give conflicting context items. How far apart do the detection thresholds need to be to avoid this (ie can it be 84 and 85% or does it need to be more like 80 & 85%)
