Big screens flash, groups push, ten minutes later nobody opens a document. Or thresholds too sensitive—on-call drowns and mutes everything. Metric anomaly alerting order must be: first define abnormal (definition, window, baseline, exclusions), then who responds in ten minutes, who escalates, how to close. Undefined alerts are decoration; unowned alerts are noise.
Ten minutes is not harsh—it turns "seen" into "owned." Own first, investigate second—not never own.
Abnormal Is Protocol, Not Gut Feel
Example: delivery promise achievement below threshold for two consecutive hours AND order volume above minimum sample. Seasons and campaigns use another baseline. False positives get definition reviews—not on-call blame. Definitions live in the metric dictionary, shared with dashboards.
- Each alert has one primary responder, AB backup, contact in system—not email signatures.
- Claim, handle, close—close requires reason code.
- Silencing needs approval, auto-restores on expiry—no permanent mute.
Response Must Be Drilled, Not Just Configured
The XYN digital intelligence system routes metric anomalies to on-call claim—ten minutes unclaimed escalates. Drills beat thresholds: use one real anomaly to see if you can find a person. Cannot—fix the directory before the algorithm.
Pick one metric for ten-minute response pilot. Expand after it works. Turn all alerts on first—on-call will vote against the system with mute.
