Cockpit watches your detections every 15 minutes and raises an alert in three cases: the share of content flagged by a check moves sharply within a day, a provider's errors stay high for an hour, or two detectors that answered the same files disagree too often.
Every alert is emailed to your account's owners. If you want it in your own tools as well, add a webhook address in Install widget: Cockpit sends a small JSON message with the check, the provider, the value, the threshold and a plain-words explanation.
On the Health page each alert has a 'Why did this alert fire?' link. The explanation says what changed, by how much and since when, in a sentence a non-engineer can act on.
Alerts do not change your detection. They tell you where to look. With the Control plan you can then adjust the threshold or add a second opinion, and every change is logged with who made it and why.