389 Alert Rules. We Shipped 31. Here's Why.

389 alert rules. Half were duplicates. A quarter were for servers that no longer existed. I designed 31 that actually matter. 92% less noise. Zero false negatives. Incident response got faster because every alert matters. In this video: 00:00 — 389 → 31: not reduction, redesign 00:24 — Alert hoarding: the enterprise disease 00:47 — The 31 that matter 01:25 — The DCR split: 97% log reduction 02:00 — Level 4: the information log problem 02:32 — More alerts ≠ better monitoring #monitoring #azure #devops #alerting #observability