diff --git a/netdata/health.d/cpu.conf b/netdata/health.d/cpu.conf
new file mode 100644
index 0000000..dbdf004
--- /dev/null
+++ b/netdata/health.d/cpu.conf
@@ -0,0 +1,25 @@
+# Silence the stock 10min_cpu_usage notification. Cryptominer detection is
+# now handled directly and far more precisely by Falco (process/network
+# behavior, not aggregate load) - see falco/rules/miner-detect.yaml and
+# falco/rules/miner-pool-ports.yaml. This alarm was firing several times a
+# day from Ollama's own legitimate sustained CPU use (subwave-controller
+# driving chat completions), with no way to distinguish that from a real
+# problem using system-wide CPU % alone. Kept evaluated (still visible on
+# the netdata dashboard/API) but routed to the "silent" role, which has no
+# configured recipients, so it no longer reaches Telegram or Netdata Cloud
+# email - same idiom as the stock file's own comment recommends.
+
+   template: 10min_cpu_usage
+         on: system.cpu
+      class: Utilization
+       type: System
+  component: CPU
+host labels: _os=linux
+     lookup: average -10m unaligned of user,system,softirq,irq,guest
+      units: %
+      every: 1m
+       warn: $this > (($status >= $WARNING)  ? (75) : (85))
+       crit: $this > (($status == $CRITICAL) ? (85) : (95))
+      delay: down 15m multiplier 1.5 max 1h
+    summary: System CPU utilization
+         to: silent