Manuel Ceroni enhanced port scan alerting in the ntop/ntopng repository, focusing on improving both detection sensitivity and triage urgency for network security events. He extended the alert interval from five to eight minutes, balancing thoroughness with timely detection, and introduced an urgent-review flag by integrating alert:set_require_attention() to ensure immediate attention for critical alerts. Working primarily in Lua and leveraging his expertise in alerting systems, Manuel maintained clear code traceability through detailed commit messages. His work addressed the need for faster threat response and maintainable alerting logic, demonstrating a thoughtful approach to both technical implementation and operational effectiveness.