Yeah, I just dove into that thing. The real‑time feed is slick, but the false‑positive rate is still higher than I’d like. It flags everything from a benign Windows update to a legit custom script, so you’re going to spend a lot of time filtering. If you’re hunting shadows, you’ll need to tweak the thresholds yourself—don’t rely on the out‑of‑the‑box config. Keep an eye on the anomaly score curve; that’s where the real zero‑days tend to surface. Good luck with the hunt.