Alert intelligence
Which rules are useful, which are noise, and which have never fired at all.
Incidents & On-Call → Alert Intelligence grades your alerting on the only thing that matters: did a human do something about it?
What it measures
| Metric | Question |
|---|---|
| Fire count | How often does this rule go off? |
| Acknowledge rate | How often does somebody claim it? |
| Time to acknowledge | How long before anybody looks? |
| Auto-resolve rate | How often does it fix itself before anybody arrives? |
| Mean duration | How long is it usually true? |
| Never fired | Has it produced a single alert since it was created? |
The three shapes worth acting on
Noise
Fires often, rarely acknowledged, usually auto-resolves in under the time it takes to open a laptop. The condition is real but transient.
Fix: raise For. A rule that is right but early teaches people to ignore it,
and that habit does not stay confined to the one rule.
Flapping
Fires and resolves repeatedly, on a value sitting on the threshold.
Fix: widen the gap between the firing and recovery conditions, or set a
Cooldown. A rule that pages four times an hour about the same condition is one
alert as far as a human is concerned.
Never fired
Created, enabled, and silent since. Either nothing has gone wrong, or the rule cannot fire.
Fix: check it deliberately. AccelerUp marks a rule that has never produced a reading as never run rather than healthy, because those look identical on a dashboard and only one of them is good news.
A rule that has never fired is the most dangerous kind of monitoring, because it is indistinguishable from working monitoring until the day you need it.
Suppression and pre-fire triage
Some sources support suppressing an alert before it reaches anybody, using statistical confidence rather than a raw threshold. See Endpoint guard, which uses a Wilson lower bound and K-of-N persistence, and can ask the Copilot for a verdict in shadow or gating mode.
See also
- Escalation & response analytics — the human half: how long it took to acknowledge and resolve, by team and by hour.
Where this behaviour lives: frontend/src/app/alerts/intelligence/. If the code and this page disagree, the code is right — please fix the page.
Part of Incidents and on-call — Turning a reading into a page, and a page into a resolved incident.