Third-Party Alert Ingestion
Vendor alerts ingested into your system.
Common third-party alert sources
AWS Health: AWS-side incidents affecting your account. Critical for region-wide issues.
Vendor status pages: Datadog, GitHub, Stripe, others. Subscribe to status page webhooks.
Third-party APIs: when a dependency degrades, alert before customers notice.
Normalisation
Translate vendor severity to your severity scheme. Vendor 'high' may be your sev 2 or sev 3.
Add context: which of your services depend on the vendor? Surface to the right on-call.
Filter aggressively. Vendor status pages often report things that don't affect you.
Dedupe with internal alerts
Vendor degraded; your alerts firing. Group these as one incident.
Without dedupe: duplicate pages for the same root cause. With dedupe: one alert with multiple contributing signals.
Manual operator override when grouping is wrong. Don't over-trust automation.
Operating ingestion
Per-vendor health dashboard. Quick reference during incidents.
Monthly review: which vendor alerts fired? Which were actionable? Tune subscriptions.
Annual: which vendors are critical enough to pay for premium status integration?