Set one weekly prompt containing the questions no alert can answer: what fired most often, which alerts nobody acted on, and what went wrong that nothing was watching for. Alerts are event-shaped and can only report occurrences. Patterns across occurrences are invisible to them by construction, and patterns are where the fixable problems are.
Why this one is worth an interruption
Every other page in this cluster adds something that interrupts people. This one exists because a set of alerts with no review process degrades: thresholds drift out of date, alerts nobody acts on stay switched on, and the channel slowly becomes unreadable.
The most valuable question is the one about alerts nobody acted on. An alert that fires regularly and produces no action is not neutral. It is actively consuming the attention the useful alerts depend on.
The threshold
A prompt rather than a report, because questions get answered and reports get skimmed.
| Condition | Set it to | Why that number |
|---|---|---|
| Cadence | weekly, same time | Predictable enough to become habit |
| Length | under 15 minutes | Longer and it gets skipped in busy weeks |
| Question 1 | what fired most this week | Frequency points at a threshold to tune |
| Question 2 | what fired and nobody acted on | Candidates for deletion or demotion |
| Question 3 | what went wrong that nothing caught | Candidates for a new alert |
| Output | one change | A list of improvements produces none |
Who should receive it
Whoever owns operations, with whoever actually receives the alerts present.
- Whoever owns the alert configuration.
- The people who actually receive them, who know which ones they have started ignoring.
- Not everybody. Three people is usually the right size.
What to do when it fires
- Ask which alerts were ignored, and believe the answer rather than defending the alert.
- Delete or demote anything that fired without producing action twice in a row.
- Tune one threshold rather than several, so you can tell what the change did.
- Add at most one new alert per review, because the total is a budget.
When not to set this alert
If you have fewer than about five alerts configured, this is overhead. Review them quarterly instead.
If the review becomes a status meeting, stop holding it. It has one job, which is keeping the alert set honest, and a meeting that has acquired other purposes will not do that job.
Common questions
Why review alerts at all?
Because thresholds drift out of date, and alerts that fire without producing action stay switched on indefinitely, consuming the attention the useful ones depend on.
What should a weekly operations review cover?
What fired most often, what fired that nobody acted on, and what went wrong that nothing was watching for. Then one change, not a list.
How do I know an alert should be deleted?
It fired and produced no action, twice in a row. That is not a neutral outcome: it is spending attention and returning nothing.