Aggregation & Correlation • Room 2

Multi-KPI Alerts

Multi-KPI Alerts create compound conditions that only fire when multiple KPIs breach simultaneously. For example, alert only when "Response Time > 5s" AND "Error Rate > 10%" are both true at the same time.

This prevents false positives from isolated spikes. A brief CPU spike that self-resolves should not page an on-call engineer. Multi-KPI alerts ensure incidents are only escalated with corroborating evidence.

Combine time conditions: "only alert if CPU > 90% AND Memory > 85% for at least 5 consecutive minutes."

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Complete the sentence about compound alerting:

Multi-KPI Alerts fire only when multiple KPIs breach their simultaneously, reducing false positives from isolated spikes.