One tested event with a meaningful condition, noise control, a named owner, and evidence from detection through recovery.
Define the condition in operating language
Choose the variable and condition that matter to the equipment or service outcome. A raw threshold is rarely enough; operating mode, persistence, data quality, and reset behaviour may change its meaning.
- Trigger condition and severity.
- Persistence time or number of consecutive samples.
- Hysteresis or a separate recovery threshold.
- Suppression rules for maintenance or known operating states.
- Behaviour when data becomes stale or unavailable.
Route an action with enough context
Notifications and webhooks should carry the asset, variable, measured value, threshold, event time, severity, and a stable event identifier. The receiver should know whether it is a new incident, a reminder, or a recovery.
- 01Name the person or system accountable for acknowledgement.
- 02Choose the channel or downstream workflow appropriate to the severity.
- 03Include a direct path to the relevant asset and evidence.
- 04Define escalation when acknowledgement does not arrive in time.
Test detection, noise, and recovery
Exercise values below, at, and above the threshold; a noisy signal near the boundary; stale data; repeated delivery; and recovery. Check both the platform history and the receiving workflow.
Completion check: one simulated condition creates one owned incident, and the incident closes only after recovery evidence is recorded.