Work through these in order:
Raise the threshold - a higher multiple, a bigger σ, a larger materiality percentage.
Raise the reliability floor - minimum impressions/conversions/spend, so thin data can't fire it.
Lengthen the hold - require the problem to persist longer before alerting.
Use the guardrails - e.g. the disapproval rule's policy-topic allowlist for expected policy reasons, or the network-leak whitelist for deliberate opt-ins.
Check the live estimate where available - dial until "would have fired" looks sane.
Check it's toggled on (PMax placement quality ships off by default).
Check the reliability floors - an account below the minimum spend/impressions/conversions can't trigger.
For security rules, check the trusted baseline - if everyone's already on the known list, silence is success.
Remember cooldowns - a standing issue that already alerted won't re-alert until its cooldown ends.