"Calculate" action enables anomaly detection

Use the Calculate action to compare hourly vs. daily Kibana hit counts and suppress alerts below a threshold — enabling dynamic anomaly detection.