These notifications are actually coming from CSF.
Since CSF is not dedicated to any 1 type of server, the csf.pignore file has to be customized for different items.
You can view/edit/add to the generic csf.pignore file with nano that CSF installs at:
nano /etc/csf/csf.pignore