Give it a week of alerts and ask which ones nobody acts on

Two hundred alerts this week, and somebody looked at about ten. The other hundred and ninety teach everyone to ignore the dashboard, and that's how the one that matters gets missed.

Export a week of them, and add a column for what happened: fixed, ignored, cleared by itself. That column is what turns a list into something useful. Do the counting in a pivot table, because exact counts are spreadsheet work, then paste in the summary with a sample of the raw alerts.

Below is a summary of a week of alerts from [MONITORING SYSTEM] (alert
name, how many times it fired, how many had no action taken, how many
cleared within 10 minutes) and a sample of the raw alerts.
1. Which alerts look like tuning candidates: fired often with no action
   taken?
2. Which always clear by themselves?
3. Which fire together, within a minute of each other, and might be one
   problem reported many times?
4. For each candidate, suggest one option: raise the threshold, wait
   before alerting, group them, or retire it. Say what we'd lose.
Don't suggest removing an alert on a critical system without flagging it
for a person to decide.

Summary: [PASTE]
Sample: [PASTE]

Without the "what was done" column all it can do is count the noise. With it, it can point at alerts that nobody seems to act on.

Be careful with the quiet ones. Never retire an alert just because it hasn't fired. A rare alert might be exactly the one you need, and a week of data can't tell you that.

Change one thing at a time and look again after a fortnight. And write down who decided and why. "We turned this off because..." is a sentence you'll want to have on hand if something goes wrong.

Incident comms for two audiences is the follow-on for the alerts that do matter.