You don't need a quarter-long project to find your worst alerts. A single HelixQL query and an afternoon is enough to find where to start.

Teams keep telling us alert cleanup is a multi-week project. Ours took an afternoon, because the hard part was never the analysis — it was deciding to look.

One query, ranked two ways

We ranked every alert two ways in the same query: by raw fire count, and by fire count weighted against action rate. The first ranking tells you what's loud. The second tells you what's actually worth fixing — an alert that fires 200 times and gets acted on 190 of them is healthy noise; one that fires 200 times and gets acted on 3 is the real target.

from alert_history
| where fired_at > ago(90d)
| summarize fires = count(), actioned = countif(resolution != "no_action") by alert_name
| extend action_rate = round(actioned * 100.0 / fires, 1), weighted_score = fires * (1 - actioned * 1.0 / fires)
| order by weighted_score desc
| take 15

Fifteen alerts, not fifty

We capped the audit at the top 15 by weighted score rather than trying to review every alert in the system. That constraint is what made it fit in an afternoon — the long tail of low-volume alerts genuinely isn't worth a team's attention in a single sitting, and chasing it is how these projects balloon into a quarter.

Assign one fix each, due before the next audit

Every alert in the top 15 leaves the meeting with exactly one assigned action: delete, demote, or fix the underlying threshold. We schedule the next audit for 30 days out on the calendar before the meeting ends, which is what actually makes the second audit happen.

Bring the query, not a pre-made slide deck

We run the query live in the meeting instead of presenting a static export from last week. Alert data moves fast enough that a five-day-old snapshot has already drifted, and running it live also means anyone in the room can suggest a filter tweak on the spot — narrowing to one team's services, say — without waiting for someone to regenerate a deck.

  • Rank alerts by fire count weighted against action rate, not raw volume alone.
  • Cap the review at the top 10–15 alerts to fit in a single afternoon.
  • Assign one concrete action per alert — delete, demote, or fix — before the meeting ends.
  • Run the query live in the meeting rather than presenting a stale export.
  • Schedule the next audit immediately so it actually recurs.