How the agent authors a check
Connect a PostgreSQL or ClickHouse database, then either click Suggest checks or describe what you want to watch in plain English. The agent:- Inspects your schema — tables, columns, and types over a read-only connection.
- Samples a little data and tests candidate queries to calibrate a baseline.
- Drafts a query and threshold — baseline-aware where it helps (rolling averages, window functions, z-scores).
- Presents the result for review. Nothing runs until you enable it. The SQL is always visible and editable.
Only query structure and small result samples are sent to the model (Anthropic
by default, with OpenAI as an alternative provider). Bulk data is never
uploaded, and Alertee does not call a model on every alert — the model work
happens during deliberate authoring and scheduled review.
Keeping it tuned
A managed check carries anext_model_review_at date. When it comes due, the
agent re-examines the check against current data and decides whether the query
or threshold should change. The cadence is proportional to how volatile the
data is — typically every few days to a couple of weeks.
Every review is recorded with a before/after SQL diff, the new condition, the
model used, and the reasoning — whether or not anything changed. You can see
the full history of a managed check’s reviews in the dashboard.
Converting a check you wrote
You can hand a check you authored over to Alertee from the check’s ⋯ menu → Convert to Alertee-managed (also on the check’s detail view). This doesn’t flip a switch blindly: Alertee reviews the check against its recent history and shows you exactly what it proposes — a before/after SQL diff, the new condition, and its reasoning — before anything is applied. Approve it to enable managed mode with that change, or decline and nothing happens. If Alertee decides the check is already well-calibrated, it says so and simply enables managed mode without altering your query. Your alert level, schedule, alert routing, and grace period are never touched by the switch — only the SQL and condition come under Alertee’s review. Both single-value and grid (multi-dimensional) checks can be managed — Alertee keeps a grid check multi-dimensional when it reviews it. Heartbeat and push checks can’t be managed: their values arrive from outside, so there’s no query for Alertee to author. When the data only moves on weekdays and goes flat on a known set of holidays, Alertee attaches the matching calendar (NYSE = US market holidays, UK = UK bank holidays, plus LSE, TSX, XETRA, EURONEXT) so the check stays quiet on those closed days instead of firing a false alarm. A calendar only affects which days are quiet — time-of-day stays with the check’s schedule, and the two compose. This happens both when Alertee authors a check (it confirms the weekday/holiday pattern in the data first) and when it reviews a managed one. You’ll see it in the convert proposal before you approve, and you can change or clear it anytime.Taking a check back
You can convert a managed check to user-owned at any time from ⋯ menu → Take back manual control. The agent stops reviewing it and it behaves like any check you wrote yourself — there’s no lock-in. If Alertee rewrote the check while managing it, you choose what to keep: keep Alertee’s current version, or restore your original — the exact query and condition you wrote before Alertee first changed it.Related
- Checks overview — anatomy and ownership
- Conditions — what the threshold compares against
- The Inbox — incident outcomes feed back into noise reduction