Finding what matters.
WHAT TO DETECT
Values outside safe ranges Rates of change that are implausible Devices that stopped reporting Readings inconsistent with neighbours Patterns preceding known failures
WHY RATE OF CHANGE MATTERS
A slow drift and a sudden jump mean different things, and absolute thresholds catch neither reliably.
WHAT SILENCE MEANS
Either nothing changed, or the device failed.
WHAT DISTINGUISHES THEM
A heartbeat.
WHAT COMPARISON WITH NEIGHBOURS REVEALS
A faulty sensor, when nearby devices disagree.
WHY THAT IS POWERFUL
It separates device faults from real conditions without a reference instrument.
WHAT SEASONALITY REQUIRES
Expectations varying by hour, day and season.
WHY
Fixed thresholds generate alerts every morning and every dry season.
WHAT TO BASELINE FROM
Enough history to capture that variation.
WHAT ALERT FATIGUE CAUSES
Real problems ignored among noise.
WHAT REDUCES IT
Requiring a condition to persist before alerting Grouping related alerts Suppressing known-benign patterns Tuning against actual response capacity
WHAT TO REVIEW
Alerts that fired and were dismissed.
