alert-router

Route anomaly-score events into deduplicated alert records for fraud response.

Updated Mar 3, 2026

Search Tags:#redis #deduplication #kafka #anomaly detection #timescaledb #slack notifications #alert routing

Ready to run

npx skills add https://github.com/GaneshMadarasu/real-time-anomaly-detection-pipeline --skill alert-router

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: alert-router
Source: https://github.com/GaneshMadarasu/real-time-anomaly-detection-pipeline/tree/main/.claude/skills/alert-router
Command: npx skills add https://github.com/GaneshMadarasu/real-time-anomaly-detection-pipeline --skill alert-router

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you manage real-time anomaly alerts by separating true fraud signals from noisy event streams, then routing the important ones to storage and notifications with minimal duplication.

Core Features & Use Cases

Severity bucketing: Converts anomaly scores into LOW, MEDIUM, HIGH, or CRITICAL alerts so responders can prioritize quickly.
Redis deduplication: Prevents repeated alerts for the same user and severity using TTL-based keys.
Database and Slack fanout: Writes de-duplicated alerts to TimescaleDB and optionally posts high-severity events to Slack.
Use Case: A fraud monitoring pipeline can feed scored transactions into this Skill to suppress repeats, persist alert history, and notify the operations team only when needed.

Quick Start

Use the alert-router skill to explain how anomaly scores are bucketed, deduplicated in Redis, written to TimescaleDB, and sent to Slack.

Frequently Asked Questions about alert-router

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I deduplicate fraud alerts in a Kafka monitoring pipeline?▼

Deduplicate fraud alerts in a Kafka pipeline by applying Redis TTL-based keys to suppress repeated events for the same user and severity, then routing the unique records to downstream storage and notifications.

What is severity bucketing for anomaly detection alerts?▼

Severity bucketing for anomaly detection alerts converts continuous anomaly scores into discrete LOW, MEDIUM, HIGH, or CRITICAL categories, allowing fraud responders to prioritize incidents quickly and trigger appropriate escalation workflows.

How do I route anomaly scores to TimescaleDB and Slack notifications?▼

Route anomaly scores to TimescaleDB and Slack by consuming scored events from Kafka, applying Redis deduplication, persisting all unique alerts to the database, and optionally fanning out high-severity events to Slack channels.

Does alert routing require dual-consumer coordination and Prometheus metrics?▼

Alert routing in this context requires dual-consumer coordination to manage Kafka consumption safely, while integrating Prometheus metrics to monitor throughput, deduplication rates, and ensure resilient shutdown and retry behavior.

What is the best way to stop duplicate Slack notifications for high-severity fraud events?▼

The best way to stop duplicate Slack notifications for high-severity fraud events is to use Redis TTL-based deduplication keys before the fanout stage, ensuring only the first occurrence of a specific user and severity triggers a notification.

When should I not use Redis TTL deduplication for anomaly alert routing?▼

You should avoid Redis TTL deduplication for anomaly alert routing if your fraud monitoring pipeline requires every single event occurrence to be recorded regardless of overlap, as TTL keys intentionally suppress repeated alerts within their expiration window.