AgentsIQ
Alert Analyser ▾
Alert Analyser Overview API Reference

🚨 Alert Analyser

OpsGenie alert triage, noise classification, suppression recommendations and incident ticket management

v1.2.0 Internal FastAPI + PostgreSQL Updated 2026-07-16 Port 8001

4 Data Sources

OpsGenie standalone, OpsGenie Cloud, Atlassian JSM, and file upload (JSON/CSV) for alert ingestion and enrichment.

Classification Engine

Rule-based noise detector scoring repeat rate, auto-close time, priority, and open duration to classify genuine vs noise vs suspect.

Incident Pipeline

Automated ticket creation and state progression: ESCALATED → INVESTIGATING → RCA_COMPLETE → REMEDIATING → RESOLVED / MANUAL.

Technical Architecture

Stack

  • Compute: FastAPI (Python 3.11) on AgentsIQ platform (port 8001)
  • Storage: PostgreSQL — alert_reports (uploaded data), incident_management.incidents (ticket pipeline), agent_config (settings)
  • Classification: Rule-based noise detector (noise_detector.py) with configurable thresholds
  • Data Sources: OpsGenie API (standalone + cloud), Atlassian JSM, file upload (JSON/CSV)
  • Optional backends: Redis (cache), Vector DB (embeddings for RAG), Neo4j (graph) — configured via env

Data Flow

OpsGenie / JSM / File
→
Alert Analyser (8001)
→
noise_detector.py
→
Genuine Alerts
→
incident_management.incidents
Browser (Portal)
→
Backend
→
Alert Analyser
→
Claude tool-use

Database Schema

PostgreSQL Tables

alert_reports
id
INTEGER (PK)
agent_slug
VARCHAR
filename
VARCHAR
total_alerts
INTEGER
genuine_count
INTEGER
noise_count
INTEGER
suspect_count
INTEGER
status
VARCHAR
report_data
TEXT/JSON
stats_data
TEXT/JSON
created_at
TIMESTAMPTZ
incident_management.incidents
id
UUID (PK)
alert_id
TEXT (dedup key)
alert_signature
TEXT
status
TEXT
priority
TEXT (P1-P4)
title
TEXT
alert_payload
JSONB
rca_findings
JSONB
action_outcome
JSONB
recurrence_count
INTEGER (default 1)
escalated_at
TIMESTAMPTZ
resolved_at
TIMESTAMPTZ
agent_config
id
INTEGER (PK)
agent_slug
VARCHAR
key
VARCHAR
value
TEXT
updated_at
TIMESTAMPTZ

Noise Classification Rules

Alert Analyser uses rule-based scoring to classify alerts as NOISE, GENUINE, or SUSPECT. The scoring function sums points for each rule:

+2
Alert fires more than 3 times within 1 hour (high repeat rate)
+2
Alert auto-closes in less than 5 minutes without acknowledgement
+1
Alert was never acknowledged (no human interaction)
-3
Priority is P1 or P2 (high severity overrides noise signals)
-2
Alert open more than 30 minutes (active issue, not noise)
Threshold
NOISE if net score > 0 · Otherwise GENUINE

Dashboard Features

📊 Overview Tab

Total alerts, genuine %, noise %, MTTR trend, alert volume chart, team breakdown, top noisy alert aliases.

✓ Genuine Alerts Tab

Filtered genuine alerts with priority distribution, open duration analysis, top patterns for RCA.

🔕 Noise Alerts Tab

Noise patterns, top offending aliases, suppression candidates, auto-close time distribution.

📈 Trends Tab

Alert volume over time, month-over-month comparison, period summary KPIs, spike detection.

🎯 Escalated Incidents Tab

KPI panels (Pipeline Flow, Ticket Aging, Resolution Method, Recurrence Signal), Priority lanes kanban, ticket detail popup with alert_payload.

🤖 AI Insights

Claude tool-use loop: classify_alerts, build_dashboard, get_suppression_recommendations with context from full alert history.

Incident Pipeline

ESCALATED
→
INVESTIGATING
→
RCA_COMPLETE
→
REMEDIATING
→
RESOLVED

Key Features

  • Dedup key: alert_id (not alert_signature) — same alert across multiple sources is one ticket
  • Recurrence: If alert_id fires again during remediation, bumps recurrence_count on existing ticket
  • Related tickets: Links new ticket to prior resolved ticket for same alert_id for pattern tracking
  • Auto-reconciliation: Stale ESCALATED tickets auto-resolved when alert clears in source system
  • Manual fallback: If no automation available, ticket remains MANUAL for human triage

SLA Policy

Priority Severity Response SLA Resolution SLA
P1 Critical 15 minutes 2 hours
P2 Major 30 minutes 4 hours
P3 Minor 60 minutes 8 hours
P4 Internal 240 minutes (4 hours) 3 business days

What's Working vs Planned

Feature Status Notes
File upload (JSON/CSV) ✓ Working OpsGenie export format support, validation, batch processing
OpsGenie standalone sync ✓ Working API key auth, periodic sync, alert history pull
OpsGenie Cloud sync ✓ Working OAuth2 flow, multi-region support, real-time webhook
Atlassian JSM sync ✓ Working Issue type mapping, custom field extraction, queue sync
Noise classification (rule-based) ✓ Working 5 scoring rules, configurable thresholds, real-time classification
Suppression recommendations ✓ Working Top noisy aliases, suggested alert rules for suppression
Dashboard: Overview, Genuine, Noise, Trends tabs ✓ Working Real-time KPIs, charts, filtering by priority/team/source
Escalated Incidents dashboard (kanban + KPI) ✓ Working Priority lanes, ticket aging, SLA breach highlighting, detail popup
Incident ticket creation with dedup ✓ Working alert_id as dedup key, recurrence counter, related ticket linking
SLA breach tracking (P1-P4) ✓ Working Real-time aging panel, color-coded breach status, MTTR calculation
Ticket detail popup with raw alert_payload ✓ Working Full JSONB rendering, searchable content, export option
Auto-migration on startup (idempotent) ✓ Working Alembic schema migrations, backwards compatibility, safe rollback
Teams escalation via shared notifier ✓ Working Adaptive Card format, P1/P2 critical alerts, webhook routing
OpsGenie status field resolution detection ⏳ Planned Currently unreliable; needs message field parsing (pending bracket-format standardisation)
Resolution ring auto vs action split ⏳ Planned Needs explicit resolution_type field (Action Agent not yet built)
P5 priority SLA threshold ⏳ Planned Not yet defined; waiting on org SLA policy
Search/filter/sort in kanban lanes ⏳ Planned UX enhancement for large incident queues
RCA Agent (polls incident_management.incidents) ⏳ Planned Not yet built; waits on incident pipeline stabilisation
Action Agent (closes tickets) ⏳ Planned Not yet built; waits on RCA Agent findings schema
RAG knowledge base ⏳ Planned Pattern matching across historical incidents via embeddings
Environment and affected_resource enrichment ⏳ Planned Pending bracket-format standardisation across sources

Key Business Outcomes

  • Reduces alert fatigue: Noise alerts identified and suppressed before reaching on-call engineers. Team productivity improves immediately post-deployment.
  • Automated ticket creation: Genuine alerts create traceable incident tickets without manual intervention. Eliminates "who created this ticket?" visibility gap.
  • SLA visibility: Real-time aging panel shows which tickets are breaching response targets. Enables priority-aware work queueing.
  • Recurrence detection: Tickets that re-fire during remediation are surfaced immediately. Fix validation catches broken patches in minutes, not days.
  • Audit trail: Full alert_payload preserved in ticket for RCA teams. Enables forensic analysis and pattern discovery after resolution.
  • Future-ready: incident_management schema is shared with planned RCA and Action agents via polling model. New agents can be added without data model changes.