Monitoring Alert Noise Reduction Agent

Admins get paged for alerts that clear themselves or need no action, and after enough noise they start missing real problems. Each month this agent exports a month of alerts and incidents, groups the alerts and scores them by how often they fired, flapped, duplicated others or led to any action. It proposes changes: flapping alerts get delays, duplicates are merged and alerts that never led to action get higher thresholds. Then it replays each change against past incidents. A change is kept only if it cuts alerts and every past incident would still have alerted. If a change would hide a past incident, it drops or softens it and replays again. The admin approves all changes. Edge case: alerts linked to compliance requirements are never removed, even if nobody acted on them.