The fastest way to break an alerting system is to fire too much. The on-call lead mutes the channel by week two, and the moment something real hits they miss it. Augur's job is to fire loudly when it matters and stay silent when it doesn't.
One number
We normalise every event to a 0–100 severity score, computed at ingest time. An M3.0 earthquake under nobody scores ~15. An M5.5 quake under a port scores ~75. A GDELT article about a national election scores ~30. A confirmed conflict report with civilian casualties scores ~85.
The exact formula varies per feed — USGS magnitude + USGS PAGER population exposure for quakes, NHC cone + landfall probability for hurricanes, GDELT goldstein-scaled tone for news — but the output is one comparable number.
Per-zone thresholds
Each watch zone has its own min_severity. Default 40. For an operations Slack channel, push it to 60. For a national-day SOC briefing where you only want the truly bad stuff, push it to 80. A noisy port zone might run at 70; a quiet refinery zone might run at 30.
The whole user-tunable surface area is one number per zone. No rule engines, no boolean trees, no exclusion lists. We've watched ops teams tune their severity threshold over a month until the channel hits 1-2 alerts a day and then leave it there for a year.
Snooze the rest
The other lever is per-zone snooze. Maintenance window? Hurricane season blowing up alert volume? Pause the zone for 4 hours or 7 days and the dispatcher skips it cleanly. We ship this in bundle 6 — try it on the watch-zones panel.