alert-router

Deduplicate fraud alerts in a Kafka pipeline by applying Redis TTL-based keys to suppress repeated events for the same user and severity, then routing the unique records to downstream storage and notifications.

Severity bucketing for anomaly detection alerts converts continuous anomaly scores into discrete LOW, MEDIUM, HIGH, or CRITICAL categories, allowing fraud responders to prioritize incidents quickly and trigger appropriate escalation workflows.

Route anomaly scores to TimescaleDB and Slack by consuming scored events from Kafka, applying Redis deduplication, persisting all unique alerts to the database, and optionally fanning out high-severity events to Slack channels.

Alert routing in this context requires dual-consumer coordination to manage Kafka consumption safely, while integrating Prometheus metrics to monitor throughput, deduplication rates, and ensure resilient shutdown and retry behavior.

The best way to stop duplicate Slack notifications for high-severity fraud events is to use Redis TTL-based deduplication keys before the fanout stage, ensuring only the first occurrence of a specific user and severity triggers a notification.

You should avoid Redis TTL deduplication for anomaly alert routing if your fraud monitoring pipeline requires every single event occurrence to be recorded regardless of overlap, as TTL keys intentionally suppress repeated alerts within their expiration window.