> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traversal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Alert Intelligence

> Traversal triages every alert in your Slack channels — urgency at a glance, the reasoning behind it, and tuning suggestions for the noisy ones.

Alert channels rarely get the attention they need. Engineers either tune them out — and miss the warning that mattered — or spend hours trying to keep up with the firehose, and still miss things. And almost no one finds the time to prune and clean up noisy alerts, so the channel only gets louder.

Alert Intelligence puts Traversal in your alert channels to do that legwork. When an alert fires, Traversal investigates it automatically, tells you how urgent it is and why, and — for alerts that are just noise — suggests how to tune them. Every alert gets a meaningful response, and you never have to tag anything.

<Tip>
  For live incident channels, see [Traversal Workers](/using-traversal/workers) — a proactive agent that joins the channel and owns the response end to end.
</Tip>

## Triage at a glance

When an alert fires in a channel Traversal is watching, it reviews the alert and reacts with one of three verdicts:

| Reaction | Verdict                | Meaning                                                      |
| :------: | :--------------------- | :----------------------------------------------------------- |
|    🔴    | **Address now**        | Real and urgent — worth interrupting someone for.            |
|    🟡    | **Address soon**       | Real, but not something to page on right now.                |
|    🔵    | **Alert needs update** | Noisy, redundant, or misconfigured — a candidate for tuning. |

## The reply in the thread

Alongside the reaction, Traversal posts a short reply in the alert's thread so you can act without leaving Slack — what it found, and the reasoning behind the verdict. It comes with action buttons:

| Button                    | What it does                                                                                                     |
| :------------------------ | :--------------------------------------------------------------------------------------------------------------- |
| **View in Traversal**     | Opens the full investigation in the web app.                                                                     |
| **Re-run Investigation**  | Runs a fresh investigation — use this if the verdict doesn't look right, or the situation has changed.           |
| **Tune Alert Definition** | Appears on 🔵 alerts. Traversal locates the alert's definition and proposes an updated version to cut the noise. |

<Tip>
  Disagree with a verdict, or want to go deeper? Reply with `@Traversal` in the thread — for example, *"@Traversal this one's a real outage, dig into payments-api."* It's the same follow-up conversation you'd have on any investigation.
</Tip>

## How Traversal decides

In a busy alert channel, the same underlying problems set off the same alerts over and over. So for each alert, Traversal first works out whether it's a brand-new issue or part of something it already investigated recently. Familiar alerts get an instant response that builds on the earlier work; genuinely new ones get a fresh investigation. Either way, Traversal tells you which — and shows the reasoning behind its call.

And it never judges an alert by how often it fires. Every verdict is grounded in real context, drawn from:

* **Traversal's own investigation** of your metrics, logs, and traces
* **Your team's history** — past Slack threads where someone already dug into this alert
* **Linked tickets** in Jira or ServiceNow
* **The alert's actual contents**, not just its frequency

That context compounds: each time an alert recurs and someone adds a note in the thread, the next response gets richer. So even a low-priority alert arrives with the story behind it — and reasoning you can verify in seconds:

> 🟡 **Checkout latency above threshold** — Address soon
> Known issue — typically rate limiting from the payments provider during peak traffic.
> • Fired 47 times in the last 7 days; usually resolves within \~5 minutes.
> • Prior investigation (May 10) found the same root cause.
> • Thread from @priya (May 8): *"deploying a fix for this today."*

## Weekly alert summaries

Per-alert triage keeps you on top of the moment. Alert **summaries** give you the bigger picture: a recurring digest of an alert channel — what's urgent, what's noise, and what's changing over time.

A summary is organized into:

* **Summary** — the headline read on the channel.
* 🔴 **Address Now** / 🟡 **Address Soon** — the alerts that matter, grouped by urgency.
* 🔵 **Improve the Alert** — noisy or misconfigured alerts worth tuning.
* 📈 **Changes & Trends** — what got noisier, what recurred, what's new since last time.

### Set one up

Run `/traversal alert-summary` to open the setup form:

<Steps>
  <Step title="Choose the alerts channel">
    Pick the channel whose alerts you want summarized.
  </Step>

  <Step title="Choose where to post">
    Pick the channel to post the summary in. Traversal must be a member of that channel.
  </Step>

  <Step title="Set the time period">
    Choose how far back to look — between 1 and 90 days (7 by default).
  </Step>

  <Step title="Run once or on a schedule">
    Run a summary immediately, or set it to recur on the days and time you choose (in your local timezone).
  </Step>
</Steps>

To review, reschedule, or delete recurring summaries for your team, run `/traversal manage-alert-summaries`.

## Getting started

Alert Intelligence is enabled per channel, one team at a time. Point an alert channel at Traversal and it starts building context within minutes — **no configuration, no tuning, and nothing to maintain.** Once it's running, it gets sharper on its own as alerts recur and your team adds context in the threads.

<Tip>
  The more Traversal knows about your systems, the sharper its triage. Pair Alert Intelligence with [Knowledge Bank](/using-traversal/knowledge-bank) so it knows which alerts are usually noise, which services are business-critical, and how your team prioritizes.
</Tip>

## FAQ

<AccordionGroup>
  <Accordion title="How is this different from alert deduplication or noise filtering?">
    Noise filters mostly count how often an alert fires. Alert Intelligence investigates *why* it fired and grounds its verdict in real evidence — your telemetry, past investigations, linked tickets, and what your team already said about it in Slack. Most alerts aren't meaningless noise; they're real problems, unknowns, or misconfigured rules, and Traversal tells them apart.
  </Accordion>

  <Accordion title="Does Traversal page people or change my alert routing?">
    No. Traversal triages and explains — it reacts, posts its reasoning, and suggests fixes. It never changes your alerting, paging, or routing. You stay in control of what happens next.
  </Accordion>

  <Accordion title="What does “Tune Alert Definition” actually do?">
    For an alert marked 🔵, Traversal locates the alert's definition and proposes an updated version designed to reduce noise. Where it has access to your alerting configuration in code, it can draft the change for you to review.
  </Accordion>

  <Accordion title="A verdict looks wrong. Can I correct it?">
    Yes. Click **Re-run Investigation** for a fresh pass, or reply with `@Traversal` in the thread to add context and steer the analysis.
  </Accordion>

  <Accordion title="Can I get a summary without waiting for the schedule?">
    Yes — run `/traversal alert-summary` and choose to run it once, immediately.
  </Accordion>
</AccordionGroup>