How an alert is built?
Different anomalies in a single time series are grouped into an alert, which can include several related nodes. This provides more context for each anomaly and reduces the number of alerts sent to the user. Time series within the same node are already seen as related, so they are always alerted together. To capture relationships between different nodes, we use groups based on correlations among nodes. Time series from nodes in the same group are also alerted together.
Alerting is enabled once your environment's metrics are onboarded to the ML pipeline( Onboarding environments and metrics ). As more data is collected, these baselines and correlations improve, reducing the noise in alerts over the first few weeks. Each alert includes a field for the alert's severity and a field for the severity of each deviation ( Anomaly alerts - structure and data explained ). You can use both severities to set up notifications and automated actions.
Severity of the anomaly - this is set during the univariate anomaly detection.