BigPanda categorizes alert quality based on the amount of enrichment or context available.
The following alert quality categories are available:
Low Quality Alerts - Alerts that lack key information or which were identified as irrelevant or misconfigured. Low quality alerts do not meet the logic criteria for Medium or High Quality Alerts.
Medium Quality Alerts - An alert that contains the minimum level of information and technical context to support operator action. These alerts lack some valuable elements such as business context, dependencies, or resolution steps.
Medium Quality Alert Logic
The logic for defining medium quality alerts is CI AND Check.
The following categories and fields define medium alert quality:
|Check||Symptom of the problem.||normalized_check|
High Quality Alerts - Contains all important data needed for a team to triage and resolve the alert, with focus on business context.
High Quality Alert Logic
High Quality Alerts must meet the same criteria as Medium Quality Alerts. The additional logic for defining high quality alerts is Ownership & Routing AND Business Impact AND (Runbooks OR Dependency OR Enriched).
The following categories and fields define high alert quality:
|Ownership & Routing||The relevant part of the business and/or team that should handle it.||bp_assignment_group|
|Business Impact||The impact of the alert on the business.|
Can be priority level, application tiers, etc.
|Runbooks||Information about how the alert should be handled.||bp_runbook|
|Dependency||Understanding of the services or application it impacts.||impacted_service|
|Enriched||If the alert was enriched or not.||enrichment|
If you need to define a field outside of the defaults for an alert quality category, reach out to BigPanda Support.
For more information, see the Unified Analytics Key Metrics documentation.
Updated about 1 month ago