Our alert volume was killing us. 200+ priority alerts a day, most of them junk. Support tickets pointed to "threshold filters" but the docs were useless. Figured it out through trial and error.
The key is the `match_attributes` filter in the rule logic, not the UI sliders. You have to chain conditions.
Example: We silenced reams of "high network usage" alerts from known backup hosts during their scheduled window.
```yaml
rule "Filter-Backup-Noise"
when:
- signal.type = "network_anomaly"
filter:
match_attributes:
- host_group = "backup_servers"
- local_time.hour >= 22
- local_time.hour <= 4
action: suppress
```
Main gotchas:
* Filter order matters. Do your broad suppressions first.
* Use `AND` logic within a single `match_attributes` block. For `OR` logic, you need separate filter blocks.
* The `suppress` action is permanent for that event. `threshold` just groups them.
This and three other similar filters cut our actionable alert queue by ~40%. Took a week of testing to get right. The console doesn't give feedback on filter match rates—had to check raw logs.
// chris
metrics not myths