observability-alert-noise-analyzer

Analyze CloudWatch alarm patterns to detect duplicates, flapping, and correlated alert noise.

Updated Apr 5, 2026
One-click install
npx skills add https://github.com/schoolofdevops/401 --skill observability-alert-noise-analyzer-schoolofdevops
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: observability-alert-noise-analyzer
Source: https://github.com/schoolofdevops/401/tree/main/skills/observability-alert-noise-analyzer
Command: npx skills add https://github.com/schoolofdevops/401 --skill observability-alert-noise-analyzer-schoolofdevops

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? On-call engineers drowning in alert fatigue need a systematic way to identify which CloudWatch alarms are noise—duplicates, flapping thresholds, and correlated clusters—so they can reduce alert volume without missing real incidents. ## Core Features & Use Cases - Duplicate Detection: Identifies exact duplicate alarms monitoring the same metric, namespace, and dimensions, distinguishing them from legitimate tiered warning/critical pairs. - Flapping & Correlation Analysis: Detects alarms with more than 6 state transitions in 24 hours and clusters alarms that fire within 5 minutes of each other, including cross-domain incidents. - Noise Score & Recommendations: Produces a quantified noise score (LOW/MEDIUM/HIGH) with dedup candidates, snooze window suggestions, and escalation reports. - Use Case: After an incident where an on-call engineer received 50+ alerts, run this analysis to find that three alarms monitor the same RDS metric and two others flap nightly, then hand the cleanup list to the observability team. ## Quick Start Ask the assistant to analyze CloudWatch alarm noise in your AWS region over the last 24 hours and report duplicates, flapping alarms, and a noise score.

Frequently Asked Questions about observability-alert-noise-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find duplicate CloudWatch alarms in AWS?

Use aws cloudwatch describe-alarms to list all alarms with their MetricName, Namespace, and Dimensions, then group alarms sharing the same metric, namespace, and dimension values. Alarms with identical thresholds are exact duplicates; different thresholds indicate tiered warning/critical pairs.

How to detect flapping CloudWatch alarms?

Query alarm history with describe-alarm-history filtered to StateUpdate events over a 24-hour window and count transitions per alarm. An alarm with more than 6 ALARM-to-OK transitions is flapping, usually because its threshold sits too close to the metric's normal range.

What permissions are needed to analyze CloudWatch alarm noise?

Only read-only permissions are required: cloudwatch:DescribeAlarms and cloudwatch:DescribeAlarmHistory. The analysis never modifies, disables, or deletes alarms, so no write permissions are needed.

Can this analysis run without live AWS access?

Yes, set HERMES_LAB_MODE=mock and add the course/infrastructure/wrappers directory to PATH to use the mock-aws wrapper for offline lab analysis. Mock mode outputs display a [MOCK MODE] banner for verification.

When should I not use alert noise analysis?

Do not use it during active incident response, for creating new alarms, or for modifying thresholds directly. Also avoid concluding an alert is noise from a single 24-hour window; review at least 7 days of history before recommending deletion.