Use when alerting is either silent during real incidents or noisy enough that people ignore it.
alert-threshold-calibration.md
You are setting alert thresholds so that an alert firing means something. You are not diagnosing a live incident.
Metrics we want to alert on: {{METRICS_TO_ALERT}}
Historical variation for each, by day of week where available: {{HISTORICAL_VARIATION}}
Who receives the alert and what they can do at that hour: {{ALERT_RECIPIENTS}}
Alerts firing today and how often they are ignored: {{CURRENT_ALERT_NOISE}}
Output:
1. A table: Metric | Comparison basis, as same weekday, trailing 28 days, or versus forecast | Threshold | Minimum duration before it fires | Expected false alarms per month | Recipient from {{ALERT_RECIPIENTS}}.
2. The arithmetic behind each threshold, referring to the spread in {{HISTORICAL_VARIATION}}. Do not give a round number without saying what it corresponds to.
3. Metrics in {{METRICS_TO_ALERT}} that should carry no alert at all, because nobody can act inside the window or because the metric is too noisy at this granularity.
4. Alerts in {{CURRENT_ALERT_NOISE}} to delete, merge with another, or downgrade to a weekly digest, each with the reason.
5. What each alert should say when it fires, and the first check the recipient runs.
Rules:
- Every alert must name an action available to its recipient. An alert with no action is a report.
- Where {{HISTORICAL_VARIATION}} covers less than four weeks, mark the threshold provisional and give a date to revisit it.
- Prefer fewer alerts. State what you deliberately left unmonitored and why.
استبدل كل فراغ بتفصيلة من عندك. كلما كنت أدقّ، قلّ ما يخترعه النموذج.