<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How are you reducing alert noise in Dynatrace SaaS? in Alerting</title>
    <link>https://community.dynatrace.com/t5/Alerting/How-are-you-reducing-alert-noise-in-Dynatrace-SaaS/m-p/303199#M6435</link>
    <description>&lt;P&gt;I would first &lt;STRONG&gt;analyze the existing Problems and alerts before changing the configuration&lt;/STRONG&gt;. In many environments, a small number of alert sources, entities, services, or recurring conditions may be responsible for most of the noise.&lt;/P&gt;&lt;P&gt;Start by identifying:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;&lt;P&gt;The most frequent Problems/events&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;The entities generating them&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;Whether the source is built-in anomaly detection, Synthetic, Kubernetes, extensions, custom alerts, etc.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;Whether the alerts are actionable incidents, transient spikes, expected behavior, or duplicate/unnecessary detection&lt;/P&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;Once you identify the main sources, I would focus on:&lt;/P&gt;&lt;OL&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Tune the relevant anomaly detection at the source.&lt;/STRONG&gt; This includes both Dynatrace built-in detection and custom alerts. For built-in service, application, infrastructure, and database detection, review sensitivity, automatic baselines versus fixed thresholds, minimum traffic, persistence/duration, and entity-specific overrides where applicable. Dynatrace explicitly supports tuning these settings to avoid over-alerting.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Review custom alerts separately where they contribute to the noise.&lt;/STRONG&gt; Choose the appropriate detection model, thresholds, aggregation, and sliding window, and avoid unnecessary high-cardinality dimensions that can turn one condition into many alerts. Dynatrace's current overalerting guidance specifically recommends aggregated data, suitable detection models, and sliding windows.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Use Maintenance Windows&lt;/STRONG&gt; for deployments, patching, DR drills, load tests, and other planned activities where abnormal behavior is expected.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Improve alert scoping and context.&lt;/STRONG&gt; For new SaaS designs, I would explore &lt;STRONG&gt;Primary Grail fields/tags and Segments&lt;/STRONG&gt; rather than building new dependencies only around Classic auto-tags and Management Zones. Good context such as environment, application, team, and criticality allows detectors to be scoped more precisely.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Use Latest Dynatrace SLOs and error-budget burn-rate alerting&lt;/STRONG&gt; for critical services where appropriate. This can complement technical alerting by focusing on actual service reliability, but it doesn't replace tuning the underlying anomaly detection.&lt;/P&gt;&lt;/LI&gt;&lt;/OL&gt;&lt;P&gt;So overall:&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Analyze the noise → Identify the noisy alert sources → Tune built-in and custom detection → Scope alerts correctly → Suppress planned activity → Use SLO burn-rate alerting for critical services.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;The main principle is to &lt;STRONG&gt;reduce the noise as close to its source as possible&lt;/STRONG&gt;, rather than only filtering it later in ServiceNow or at the notification layer.&lt;/P&gt;</description>
    <pubDate>Thu, 13 Aug 2026 07:59:18 GMT</pubDate>
    <dc:creator>Mohamed_Hamdy</dc:creator>
    <dc:date>2026-08-13T07:59:18Z</dc:date>
    <item>
      <title>How are you reducing alert noise in Dynatrace SaaS?</title>
      <link>https://community.dynatrace.com/t5/Alerting/How-are-you-reducing-alert-noise-in-Dynatrace-SaaS/m-p/303190#M6434</link>
      <description>&lt;P&gt;&lt;SPAN&gt;I’m looking for some advice from the Dynatrace community on best practices for reducing alert noise in Dynatrace SaaS.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;So far, I’ve explored:&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;●&lt;/SPAN&gt; &lt;SPAN&gt;SLO-based alerts — but my understanding is that SLO alerts are not really designed to reduce alert noise. We would still need to configure Custom Alerts/Problems appropriately.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;●&lt;/SPAN&gt; &lt;SPAN&gt;ServiceNow Workflows — this seems like a good approach for filtering and managing alert noise, but the customer cannot subscribe to the ServiceNow Workflow module due to budget constraints.&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;What other approaches or best practices would you recommend for reducing alert noise directly within Dynatrace SaaS, without relying on ServiceNow or additional paid modules?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;For example, are there recommended ways to use Problem notifications, alerting profiles, management zones, event filters, Davis AI, or other Dynatrace-native capabilities to achieve effective alert/noise reduction?&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Would appreciate any real-world approaches or examples you’ve used. Thanks!&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 13 Aug 2026 02:18:12 GMT</pubDate>
      <guid>https://community.dynatrace.com/t5/Alerting/How-are-you-reducing-alert-noise-in-Dynatrace-SaaS/m-p/303190#M6434</guid>
      <dc:creator>doodledaron</dc:creator>
      <dc:date>2026-08-13T02:18:12Z</dc:date>
    </item>
    <item>
      <title>Re: How are you reducing alert noise in Dynatrace SaaS?</title>
      <link>https://community.dynatrace.com/t5/Alerting/How-are-you-reducing-alert-noise-in-Dynatrace-SaaS/m-p/303199#M6435</link>
      <description>&lt;P&gt;I would first &lt;STRONG&gt;analyze the existing Problems and alerts before changing the configuration&lt;/STRONG&gt;. In many environments, a small number of alert sources, entities, services, or recurring conditions may be responsible for most of the noise.&lt;/P&gt;&lt;P&gt;Start by identifying:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;&lt;P&gt;The most frequent Problems/events&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;The entities generating them&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;Whether the source is built-in anomaly detection, Synthetic, Kubernetes, extensions, custom alerts, etc.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;Whether the alerts are actionable incidents, transient spikes, expected behavior, or duplicate/unnecessary detection&lt;/P&gt;&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;Once you identify the main sources, I would focus on:&lt;/P&gt;&lt;OL&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Tune the relevant anomaly detection at the source.&lt;/STRONG&gt; This includes both Dynatrace built-in detection and custom alerts. For built-in service, application, infrastructure, and database detection, review sensitivity, automatic baselines versus fixed thresholds, minimum traffic, persistence/duration, and entity-specific overrides where applicable. Dynatrace explicitly supports tuning these settings to avoid over-alerting.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Review custom alerts separately where they contribute to the noise.&lt;/STRONG&gt; Choose the appropriate detection model, thresholds, aggregation, and sliding window, and avoid unnecessary high-cardinality dimensions that can turn one condition into many alerts. Dynatrace's current overalerting guidance specifically recommends aggregated data, suitable detection models, and sliding windows.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Use Maintenance Windows&lt;/STRONG&gt; for deployments, patching, DR drills, load tests, and other planned activities where abnormal behavior is expected.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Improve alert scoping and context.&lt;/STRONG&gt; For new SaaS designs, I would explore &lt;STRONG&gt;Primary Grail fields/tags and Segments&lt;/STRONG&gt; rather than building new dependencies only around Classic auto-tags and Management Zones. Good context such as environment, application, team, and criticality allows detectors to be scoped more precisely.&lt;/P&gt;&lt;/LI&gt;&lt;LI&gt;&lt;P&gt;&lt;STRONG&gt;Use Latest Dynatrace SLOs and error-budget burn-rate alerting&lt;/STRONG&gt; for critical services where appropriate. This can complement technical alerting by focusing on actual service reliability, but it doesn't replace tuning the underlying anomaly detection.&lt;/P&gt;&lt;/LI&gt;&lt;/OL&gt;&lt;P&gt;So overall:&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Analyze the noise → Identify the noisy alert sources → Tune built-in and custom detection → Scope alerts correctly → Suppress planned activity → Use SLO burn-rate alerting for critical services.&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;The main principle is to &lt;STRONG&gt;reduce the noise as close to its source as possible&lt;/STRONG&gt;, rather than only filtering it later in ServiceNow or at the notification layer.&lt;/P&gt;</description>
      <pubDate>Thu, 13 Aug 2026 07:59:18 GMT</pubDate>
      <guid>https://community.dynatrace.com/t5/Alerting/How-are-you-reducing-alert-noise-in-Dynatrace-SaaS/m-p/303199#M6435</guid>
      <dc:creator>Mohamed_Hamdy</dc:creator>
      <dc:date>2026-08-13T07:59:18Z</dc:date>
    </item>
  </channel>
</rss>

