01
Scheduled rules
Evaluate SQL periodically for windowed thresholds, aggregates, and conditions over stored telemetry.
Product · Alerting
Detect on the right path. Route with context.
Evaluate SQL on a schedule, match events in the ingest path, or use anomaly detectors—then route incidents through policies, rotations, and the channels your team already uses.
- rule kinds
- 3
- real-time match path
- <1s
- anomaly methods
- MAD + EWMA
- notification paths
- 10+
Choose the evaluation model that fits the signal.
Alerting is not forced into one polling loop when some events need immediate handling and others need a trend.
02
Real-time rules
Match predicates in the ingest path when sub-second event-to-page latency matters.
03
Anomaly rules
Use MAD and EWMA detectors with daily baselines and optional weekly seasonality.
04
Escalation and rotations
Route through multi-step policies, acknowledgement timeouts, on-call rotations, and overrides.
workflow
From detection to a resolved incident.
The rule, route, acknowledgement, and investigation remain connected.
- 101 · Evaluate
Run scheduled, real-time, or anomaly logic
Use the rule kind that matches the latency and behavior of the signal.
- 202 · Route
Apply escalation policy and ownership
Resolve the current rotation, overrides, acknowledgement timeout, and next step.
- 303 · Notify
Send to the team’s existing channel
Use Slack, email, generic webhooks, PagerDuty, OpsGenie, Teams, or common Asian group robots.
- 404 · Investigate
Open the signal with context attached
Continue into metrics, traces, and logs without recreating the incident scope.
proof / shipped
Alerting is a shipped backend and UI surface.
Rules, incidents, acknowledgement, escalation, schedules, history, and notification channels are covered by the current APIs.
- scheduled | realtime | anomaly rule model
- Incident ack and resolve endpoints
- Escalation policies, schedules, and overrides
- Slack, email, webhook, PagerDuty, OpsGenie, Teams, Feishu, WeCom, DingTalk
Product · Alerting
Detect on the right path. Route with context.
Evaluate SQL on a schedule, match events in the ingest path, or use anomaly detectors—then route incidents through policies, rotations, and the channels your team already uses.