Found during live testing: netdata's cloud-provider auto-detection runs curl --fail -s -m1 --noproxy * http://169.254.169.254 on every startup/reconnect to check whether the host is in AWS/GCP/Azure - standard monitoring-agent behavior, not a bug. Without this exception the rule would have paged every time netdata restarts. Scoped to netdata's own curl specifically so any other connection from that container still alerts.