Reducing Alert Noise with Moogsoft: AIOps Setup for Enterprise
In enterprise infrastructures with hundreds of components and dozens of monitoring systems, engineers drown in alerts. Every day—thousands of events, but only 5–10% actually reflect an incident. The rest is noise, duplicates, and irrelevant messages. We've seen projects where a single engineer handled 200+ alerts per shift. Moogsoft AIOps solves this: it automatically clusters events into Situations and reduces incident counts up to 10x.
We deploy Moogsoft turnkey: from connecting sources to calibrating MAIA and integrating with ITSM. Our track record—over 30 AIOps implementations.
How Moogsoft Reduces MTTR?
Moogsoft uses three clustering algorithms: temporal (events close in time), topological (events on related hosts/services), and textual (similar descriptions). Together they pinpoint the root cause in seconds, not hours. For example, if PostgreSQL fails on all replicas, the system merges 500 alerts into one Situation "PostgreSQL cluster failure." In a traditional approach, each alert would become a separate ticket.
What Are Events, Situations, and Workflows?
Event—a unit of incoming data. Moogsoft accepts events via REST API, Syslog, SNMP trap, email, or built-in integrations (Prometheus Alertmanager, PagerDuty, Splunk, ServiceNow).
Situation—a cluster of related events that the AI algorithm (MAIA) considers connected. One Situation can combine 50–200 events, which in a traditional approach would create 50–200 separate tickets.
Workflow—automation reacting to a Situation: Slack notification, incident creation in PagerDuty/ServiceNow, runbook execution via webhook.
Configuring Ingestion: Connecting Sources
For integration with Prometheus Alertmanager, use the built-in receiver. In alertmanager.yml:
---
receivers:
- name: moogsoft
webhook_configs:
- url: 'https://<your-tenant>.moogsoft.com/api/v1/events/prometheus'
http_config:
authorization:
type: Bearer
credentials: <api_token>
send_resolved: true
For Nagios/Zabbix, use the Moogsoft LAM (Log Adapter Module)—an agent that normalizes event format. LAM is configured via lam.conf:
ALERT_MAP {
source = HOSTNAME
type = NAGIOS_SERVICESTATUS
severity = nagios_state_to_severity($STATE$)
description = $SERVICEOUTPUT$
service = $SERVICEDESC$
}Calibrating MAIA: Teaching the Algorithm
MAIA defaults to three clustering algorithms: temporal, topological, textual. In the first weeks, the algorithm creates both oversized and undersized Situations. Key calibration parameters:
| Parameter | Description | Recommendation |
|---|---|---|
| Temporal window | Time range for grouping | 5–20 minutes |
| Similarity threshold | Threshold for textual clustering | 0.7–0.8 |
| Topology rules | Manual rules based on infrastructure | Yes, for critical services |
We always use a feedback loop: operators mark Situations as correctly or incorrectly grouped. MAIA learns from these ratings—after 4–6 weeks, grouping quality improves significantly.
Additional MAIA Calibration Parameters
- Max situations per day: limit the number of Situations created
- Minimum events per situation: minimum events to form a Situation
- Confidence threshold: algorithm's confidence to auto-create a ticket
Why Moogsoft Is More Effective Than Manual Correlation?
| Characteristic | Manual Correlation | Moogsoft AIOps |
|---|---|---|
| Incident analysis speed | Hours | Seconds |
| Tickets created per 1000 alerts | 500–800 | 10–50 |
| Root cause accuracy | 30–50% | 85–95% |
| Automation | Requires manual intervention | Full workflow automation |
Moogsoft cuts alert volume 5–10x compared to manual filtering. This saves team resources and reduces incident handling costs.
Integration with ITSM and Workflow Automation
A typical production workflow:
Situation created → webhook to Slack (#incidents channel)
→ if not acknowledged in 5 min → create PagerDuty incident
→ if Situation closed → auto-resolve PagerDuty + ServiceNow ticketIn Moogsoft, this is configured in the Workflows section via visual editor or YAML. There is a ready bidirectional connector for ServiceNow—status changes in ServiceNow automatically update the Situation in Moogsoft.
What's Included in the Work (Deliverables)
- Inventory of current monitoring sources: Nagios, Zabbix, Prometheus, APM, cloud metrics.
- Deploy Moogsoft in your cloud or on-premise (supports Kubernetes, Docker, bare-metal).
- Connect all sources via LAM or API, configure field mapping.
- Initial MAIA calibration: temporal window, similarity threshold, topology rules.
- Integrate with ITSM (ServiceNow, PagerDuty, Jira) and notification systems (Slack, Telegram, email).
- Train operators on the interface and feedback loop.
- Post-release support for 4 weeks: monitor grouping quality, fine-tune.
Implementation Process
- Audit: collect data about current event streams, volumes, and sources.
- Design: architecture for integrations, workflow automation schema.
- Deploy: install Moogsoft, configure ingestion, initial calibration.
- Testing: verify correlation on historical data, pilot run.
- Production: gradually enable sources, train algorithm, activate feedback loop.
Timeline and Cost
Basic connection with alerting setup—from 2 weeks. Full MAIA calibration and stable noise reduction—up to 12 weeks. Cost is determined after auditing your current infrastructure and event volume. We'll assess your project—contact us.
We guarantee at least a 3x reduction in incidents reaching engineers. Contact us to discuss details and order implementation.