A flood of noisy risk scores streams in every round - most normal, a few real disruptions hiding in the overlap. Set the alert threshold: too low and false alarms drown you, too high and a disruption slips through.
Risk scores for normal and disrupted events overlap. Any single threshold trades false alarms (false positives) against missed disruptions (false negatives) - you cannot drive both to zero without better features.
Each round a batch of scores is drawn from two overlapping distributions. Your threshold splits them into true/false positives and negatives; precision, recall and F1 are computed, and misses cost more than false alarms.
Set the threshold to the cost, not to raw accuracy - lower it when a miss is catastrophic. Invest in feature quality to separate the classes so precision and recall rise together.
