Smarter Incident Grouping Based on Monitor Schedule
What's new
Sifflet now uses a schedule-aware lookback window when grouping monitor failures into existing incidents. Previously, the grouping engine always searched back up to 7 days to find a candidate incident to attach a new failure to - regardless of how frequently the monitor actually ran. This could result in hourly monitors being incorrectly grouped with stale incidents from days earlier, or monthly monitors being grouped too conservatively.
The lookback window is now dynamic, automatically calibrated to the monitor's run frequency:
| Monitor frequency | Lookback window (Last incident failure) |
|---|---|
| Hourly (or more frequent) | 12 hours |
| Daily | 3 days |
| Weekly | 3 weeks |
| Monthly | 3 months |
Why it matters
Incident grouping is most useful when it surfaces related failures that are genuinely likely to share a root cause. A failure on an hourly monitor that happened 5 days ago is almost certainly unrelated to today's failure - grouping them creates noise rather than signal.
By aligning the lookback window with the monitor's natural cadence, Sifflet ensures that grouped incidents reflect temporally coherent failure patterns, making it easier for data teams to investigate root causes and avoid being distracted by outdated context.
Who is impacted
All users who rely on incident grouping. The change is applied automatically - no configuration is required.
Part of the Incident Centric Alerting initiative, aimed at making incident notifications more actionable and reducing alert fatigue.