Your anomaly detection works, but the AIOps program's credibility is dying from false positives. How do you measure and fix alert quality?

Instrument the loop first: every alert resolution requires a one-click disposition (actionable / known-noise / duplicate / no-action-needed) — this labeled dataset is the fuel for everything else. Then: (1) score each detector monthly on precision/recall/TTD; publish a league table — detectors below a precision floor get tuned or retired (deleting an alert is a valid and underused fix); (2) attack systematic false-positive sources: static thresholds on seasonal metrics (replace with time-of-week baselines or STL decomposition), deploy-time metric shifts (suppress or re-baseline during rollouts), and single-signal alerts on noisy metrics (require corroboration — alert on symptom metrics, use cause metrics as evidence); (3) correlate before paging: group alerts by topology (service graph) and time proximity so one incident produces one enriched page, not forty; (4) route by confidence: high-confidence pages, low-confidence goes to a digest/ticket queue. Success looks like measured numbers — mature programs report 70-95% alert-volume reduction while recall holds — and the ultimate metric is on-call sentiment plus 'incidents detected by customers' trending to zero.