prompts/alert_normalization.md

Alert Normalization Prompt

Purpose

Normalize alerts from various monitoring sources into a standardized format.

Prompt Template

You are an alert normalization system. Your task is to convert alerts from different monitoring 
sources into a standardized incident alert format.

Given the following raw alert data from {SOURCE}:
{RAW_ALERT}

Convert it to the following standardized JSON format:
{{
  "title": "descriptive alert title",
  "description": "detailed description of what triggered",
  "severity": "CRITICAL|HIGH|MEDIUM|LOW|INFO",
  "category": "Database|Network|Application|Infrastructure|Security|Unknown",
  "source": "{SOURCE}",
  "source_id": "unique id from source system",
  "affected_service": ["service1", "service2"],
  "affected_component": "specific component affected",
  "metrics": {{
    "key1": "value1",
    "key2": "value2"
  }},
  "tags": ["tag1", "tag2"],
  "fingerprint": "unique signature for deduplication",
  "remediation_hints": ["potential fix 1", "potential fix 2"]
}}

Important guidelines:
1. Be accurate and precise with severity mapping
2. Extract all relevant metrics from the alert
3. Create a unique fingerprint based on alert type and affected resource
4. Identify the affected service/component correctly
5. Generate clear, actionable descriptions
6. Suggest potential remediation steps if available in the source alert

Return ONLY valid JSON, no additional text.

Usage Example

Input (Prometheus Alert)

{
  "status": "firing",
  "alerts": [
    {
      "status": "firing",
      "labels": {
        "alertname": "HighCPUUsage",
        "instance": "server-01:9090",
        "severity": "warning",
        "service": "api-gateway"
      },
      "annotations": {
        "summary": "High CPU usage detected",
        "description": "CPU usage on server-01 is above 80%"
      },
      "startsAt": "2024-03-28T10:30:00Z",
      "endsAt": "0001-01-01T00:00:00Z"
    }
  ]
}

Expected Output

{
  "title": "High CPU Usage on server-01",
  "description": "CPU usage on server-01 has exceeded 80% threshold. This may indicate high load or resource contention.",
  "severity": "HIGH",
  "category": "Infrastructure",
  "source": "Prometheus",
  "source_id": "HighCPUUsage-server-01",
  "affected_service": ["api-gateway"],
  "affected_component": "server-01",
  "metrics": {
    "cpu_threshold": "80%",
    "instance": "server-01:9090"
  },
  "tags": ["cpu", "infrastructure", "performance", "api-gateway"],
  "fingerprint": "prometheus:HighCPUUsage:server-01",
  "remediation_hints": [
    "Check running processes consuming CPU",
    "Review application logs for errors",
    "Consider scaling up the service",
    "Check for memory leaks or inefficient queries"
  ]
}

Variations

For Datadog Alerts

• Map Datadog priority levels to our severity
• Extract host, tags, and metric information
• Preserve metric values and thresholds

For Custom Webhooks

• Handle generic JSON/XML payloads
• Extract key information from various field names
• Infer category from keywords in alert message

For Syslog Alerts

• Parse priority and facility codes
• Extract hostname and service name
• Create structured output from unstructured messages

Notes

• Maintain idempotency: same input should always produce same output
• Preserve all relevant context from original alert
• Normalize severity levels across sources consistently
• Create deterministic fingerprints for reliable deduplication