{"id":4140,"date":"2024-11-07T08:00:00","date_gmt":"2024-11-07T08:00:00","guid":{"rendered":"http:\/\/www.sumologic.com\/blog\/ai-driven-low-noise-alerts"},"modified":"2025-11-07T16:29:30","modified_gmt":"2025-11-08T00:29:30","slug":"ai-driven-low-noise-alerts","status":"publish","type":"blog","link":"https:\/\/www.sumologic.com\/blog\/ai-driven-low-noise-alerts","title":{"rendered":"Reduce alert noise, automate incident response and keep coding with AI-driven alerting"},"content":{"rendered":"\n
\n
\n
\n
\n
\"AI-driven<\/figure>\n<\/div>\n\n\n

Noisy monitors can lead to alert fatigue<\/a>, which frustrates engineers and hinders innovation. With our patent-pending anomaly detection capabilities built on the power of AI, you can eliminate 60-90% of alerts. A unique differentiator, Sumo Logic\u2019s alerts can also trigger one or more playbooks to drive auto-diagnosis or remediation and accelerate time to recovery for application incidents. <\/p>\n\n\n\n

Faster issue remediation means engineers can focus more time on development and releasing software. The combination of next-generation anomaly detection and automation is part of our AI-driven alerting capabilities available to all Sumo Logic customers that will change how you troubleshoot. <\/p>\n\n\n\n

Alerting challenges<\/h2>\n\n\n\n

The noisiest 5% of monitors on logs and metrics used by Sumo Logic trigger seven times per day, as in the graph below. Anecdotally, half of these noisy alerts trigger after regular work hours. These stats imply that the volume of alerts from modern applications can overwhelm on-call teams. <\/p>\n\n\n

\n
\"Alerting
Top 5% of noisiest monitors trigger seven times per day<\/figcaption><\/figure>\n<\/div>\n\n\n

A substantial portion of these alerts are often irrelevant or insignificant, contributing to alert fatigue among operators. The image below shows a monitor for a Sumo Logic customer, which, over three days, generated two false positives (i.e. false alarm) and one false negative (i.e. alert was not triggered when it should have). False positives are a distraction that pulls engineers away from their focused work, while false negatives hide genuine problems that developers actually need to act on.
<\/p>\n\n\n

\n
\"Customer
Customer monitor with two false positives and one false negative<\/figcaption><\/figure>\n<\/div>\n\n\n

For AI-driven alerting, we were convinced we could leverage real-time AI and ML<\/a> to drive up our accuracy and keep developers focused on the work they do best. <\/p>\n\n\n\n

While reducing false positives helps developers with alert fatigue, when incidents do occur, you want to resolve them quickly. AI-driven alerting also features playbooks for automating incident diagnosis and if necessary, recovery.<\/p>\n\n\n\n

Why are monitors noisy?<\/h2>\n\n\n\n

First-generation anomaly detection, such as Sumo Logic outlier<\/a>, learns dynamic baselines from recent data points and can avoid the problem of finding optimum static thresholds. However, these techniques can still generate false positives because they:<\/p>\n\n\n\n