Alerting is partly a design problem
Most monitoring systems fail because they ask people to care about too many things at once. If every dip becomes an alert, the system teaches the team to ignore it.
Good anomaly detection has to be tuned for context. Seasonality, minimum volume thresholds, and persistence rules matter as much as the detection method itself.
Why expected versus actual matters
A raw alert is rarely enough. Teams move faster when they can compare expected performance with actual performance at a glance and immediately see the scope of the issue.
That is why structured alert payloads are as important as the model: KPI, severity, affected slice, and a clear starting point for diagnosis.