Alerts that fire on the first signal, not the hundredth
Analysing a message tells you about that message. Seven alert rules now watch the stream itself: the single customer about to walk away, and the pattern forming across dozens of messages that no individual message reveals.
By Howzer Team, Engineering ·
By the time you see a pattern in a dashboard, the damage is already done.
Until now Howzer answered when asked. A message came in, it was scored, the result went back. Trends over time were visible if you went looking. What was missing was the system that looks for you, and taps you on the shoulder.
Four rules that watch a single message
- Someone is leaving: high churn risk combined with clearly negative sentiment. Either alone is common, both together is a customer with one foot out of the door.
- Legal threat: an explicit threat of legal action. Always treated as the most serious level, because the legal team needs to know today, not on Monday.
- Critical case: the urgency assessment came back at its highest level. These need a person now.
- Too many things at once: three or more separate risks all sitting at moderate. Three moderate problems in one message are usually worse than one severe one.
Three rules that watch the stream
These see what no individual message can show. They compare the last hour against what a normal hour looks like.
- Quiet hourbaseline
- Next hournormal
- Thennormal
- Something breaksalert fires
- Afterstill elevated
Illustration, not measured data. The rule compares the current hour against a rolling baseline and fires once the gap is too large to be chance.
- A flood of messages where there was none an hour ago, which usually means something is down.
- A sharp drop in mood inside a one hour window, measured against the long-term baseline. Something has changed and people are unhappy about it.
- Five or more messages with the same root cause inside fifty kilometres and two hours. That is a local incident, not a coincidence.
Alerts you can actually live with
An alert that fires forty times is an alert everybody turns off. The same alert for the same customer is suppressed for a cooldown period, and every alert has a life: raised, acknowledged, resolved. You can list what is open, filter by kind or seriousness, and close things out through the API.
A recommendation, in German, that a person decides on
Every alert arrives with a suggested next step written in German and matched to the kind of alert it is. For someone about to leave, make personal contact. For a legal threat, involve the legal team before anything automated goes out. These are suggestions. Nothing acts on them by itself.