prompts/alert_normalization.md

# Alert Normalization Prompt

## Purpose
Normalize alerts from various monitoring sources into a standardized format.

## Prompt Template

```
You are an alert normalization system. Your task is to convert alerts from different monitoring 
sources into a standardized incident alert format.

Given the following raw alert data from {SOURCE}:
{RAW_ALERT}

Convert it to the following standardized JSON format:
{{
  "title": "descriptive alert title",
  "description": "detailed description of what triggered",
  "severity": "CRITICAL|HIGH|MEDIUM|LOW|INFO",
  "category": "Database|Network|Application|Infrastructure|Security|Unknown",
  "source": "{SOURCE}",
  "source_id": "unique id from source system",
  "affected_service": ["service1", "service2"],
  "affected_component": "specific component affected",
  "metrics": {{
    "key1": "value1",
    "key2": "value2"
  }},
  "tags": ["tag1", "tag2"],
  "fingerprint": "unique signature for deduplication",
  "remediation_hints": ["potential fix 1", "potential fix 2"]
}}

Important guidelines:
1. Be accurate and precise with severity mapping
2. Extract all relevant metrics from the alert
3. Create a unique fingerprint based on alert type and affected resource
4. Identify the affected service/component correctly
5. Generate clear, actionable descriptions
6. Suggest potential remediation steps if available in the source alert

Return ONLY valid JSON, no additional text.
```

## Usage Example

### Input (Prometheus Alert)
```json
{
  "status": "firing",
  "alerts": [
    {
      "status": "firing",
      "labels": {
        "alertname": "HighCPUUsage",
        "instance": "server-01:9090",
        "severity": "warning",
        "service": "api-gateway"
      },
      "annotations": {
        "summary": "High CPU usage detected",
        "description": "CPU usage on server-01 is above 80%"
      },
      "startsAt": "2024-03-28T10:30:00Z",
      "endsAt": "0001-01-01T00:00:00Z"
    }
  ]
}
```

### Expected Output
```json
{
  "title": "High CPU Usage on server-01",
  "description": "CPU usage on server-01 has exceeded 80% threshold. This may indicate high load or resource contention.",
  "severity": "HIGH",
  "category": "Infrastructure",
  "source": "Prometheus",
  "source_id": "HighCPUUsage-server-01",
  "affected_service": ["api-gateway"],
  "affected_component": "server-01",
  "metrics": {
    "cpu_threshold": "80%",
    "instance": "server-01:9090"
  },
  "tags": ["cpu", "infrastructure", "performance", "api-gateway"],
  "fingerprint": "prometheus:HighCPUUsage:server-01",
  "remediation_hints": [
    "Check running processes consuming CPU",
    "Review application logs for errors",
    "Consider scaling up the service",
    "Check for memory leaks or inefficient queries"
  ]
}
```

## Variations

### For Datadog Alerts
- Map Datadog priority levels to our severity
- Extract host, tags, and metric information
- Preserve metric values and thresholds

### For Custom Webhooks
- Handle generic JSON/XML payloads
- Extract key information from various field names
- Infer category from keywords in alert message

### For Syslog Alerts
- Parse priority and facility codes
- Extract hostname and service name
- Create structured output from unstructured messages

## Notes
- Maintain idempotency: same input should always produce same output
- Preserve all relevant context from original alert
- Normalize severity levels across sources consistently
- Create deterministic fingerprints for reliable deduplication