Traffic on a licensing portal suddenly collapses or surges far beyond normal. What should anomaly alerting imply for responders?
Select an answer to reveal the explanation.
Short Explanation
A quiet chart can be an outage; a noisy chart can be a bot party or a big campaign. Alerts are the tap on the shoulder saying 'look twice.' Investigate the story before you celebrate or panic.
Full Explanation
Sudden traffic drops may signal outages while sudden spikes may signal attacks or campaigns; anomaly alerting should push responders to investigate before trusting the chart. Alerts are hypotheses generators for civic portal operations, not automatic celebrations or panics. Cap. 10 operations mature when anomalies drive disciplined follow-up with evidence.
Any spike does not always mean marketing success, and any drop does not always mean citizens are happier—both can indicate failure modes. Anomalies should not be ignored on the claim that web metrics never relate to operations. Auto-deleting all events on anomaly destroys baselines needed to understand what happened and blocks after-action review.
Exam caveat: tune thresholds to seasonality (tax deadlines, storms) or alerts become noise; include runbook links that distinguish bot floods from successful campaigns. Operational check: replay a historical spike and drop against the alerting rules in staging, confirm pages fire, and walk the runbook steps that verify origin before communicating externally. Document the verified decision in the municipal architecture runbook so future on-call and audit staff inherit the same standard. Document the verified decision in the municipal architecture runbook so future on-call and audit staff inherit the same standard.