The overhead of maintaining those configurations all the time is usually too high to be worth it considering the benefit and likelihood of reaping it. Also, in

The overhead of maintaining those configurations all the time is usually too high to be worth it considering the benefit and likelihood of reaping it. Also, in my experience with those systems, they only make sense to use very sparingly. Your monitoring becomes extremely fragile when your aggregations and dependencies get complicated enough that "what will our alerting system do when X happens?" results in a flow chart with 18 steps. If you aren't careful, you can end up making your aggregations less useful than the raw alerts would be.