Regarding FIM, how are others handling initialization of systems & ensuring you’re not alerting on bootstrap changes, e.g cloud_init completion? For our autoscaling & replaceable nodes this is a high noise possibility. I’m thinking of utilising something like uptime - if uptime is <30mins then ignore FIM results. Curious as to what others are doing though.