Alert deduplication and triage
Groups related production alerts and errors and ranks them so investigation starts with the most impactful.
Sub-techniques
2
| ID | Name | Description |
|---|---|---|
V1065.001 | Alert correlation | Group alerts by fingerprint, service and time window. |
V1065.002 | Impact ranking | Rank by users affected, frequency and recency. |
Craft it
- Fingerprint errors by normalised stack trace.
- Correlate within a time window per service.
- Rank before routing to people or agents.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- Alert routing and grouping rules in monitoring config.