Signal Intelligence
This domain tests how PagerDuty turns raw monitoring events into a small number of actionable incidents. It covers event ingestion, deduplication, suppression, alert grouping, correlation, and Event Orchestration. The exam focuses on reducing noise without hiding real failures.
Core rules
- Events arrive via integrations/Events API and become alerts; alerts are deduplicated by dedup_key within a service/integration scope. Same key updates the open alert; a resolve event closes it.
- Suppression intentionally prevents alerts or incidents from being created, for example during maintenance windows. Suppression is not the same as resolution.
- Alert grouping combines related alerts into one incident using intelligent grouping, time-based rules, or content-based rules. Grouping reduces incident volume but does not delete alerts.
- Event Orchestration applies ordered rules to incoming events: route to services, enrich fields, suppress, or change severity. Global Event Orchestration applies across services; service-level orchestration is scoped.
- Correlation, related incidents, and outlier detection surface context; they help responders see patterns but do not replace deduplication.
Worked example
A Prometheus integration sends 40 alerts for one node, all with dedup_key "node-17-cpu". PagerDuty deduplicates them to one alert that updates in place. A content-based grouping rule groups alerts from the same service and host into one incident. An orchestration rule suppresses events with label env=maintenance. During a maintenance window the 40 alerts produce no incident; after the window, a new alert with the same dedup_key opens one incident.
Traps
- Using a different dedup_key for every event; that creates noise instead of updates.
- Confusing suppression with resolution; suppressed events do not become incidents.
- Expecting grouping to reduce alert count; it reduces incident count.
- Forgetting rule order and scope in Event Orchestration; first matching rules and global versus service scope change outcomes.