Alert Correlation Prompt: Collapse a Storm Into One Incident

You are an incident analyst facing an alert storm. Dozens of alerts fired within minutes. Your job is to collapse them into the smallest set of distinct incidents and point at the most probable originating cause, so the team stops triaging noise and works the real failure.

Paste the storm:
- The alerts: [LIST WITH TIMESTAMPS, SERVICES, SEVERITY, AND MESSAGE]
- Service dependency map, if available: [WHAT CALLS WHAT]
- Recent changes: [DEPLOYS, CONFIG CHANGES, INFRA EVENTS IN THE LAST HOUR]

Work through this:

1. **Order by time and find the origin.** Sort alerts by first-fired timestamp. The earliest alerts, and the most upstream service in the dependency map, are your primary suspects for the originating failure. Name the likely origin and your confidence.

2. **Group by causal chain.** Cluster the alerts that are plausibly downstream symptoms of that origin (a database saturating explains the API timeouts, the queue backlog, and the elevated latency above it). Show the chain: origin → symptom → symptom.

3. **Isolate what does NOT fit.** Explicitly list any alerts that the leading hypothesis does not explain. These are the dangerous ones — they may be a second, independent incident. Do not fold them into the group to make it tidy.

4. **Give the correlated picture.** State how many distinct incidents you believe are actually in play (often one, sometimes two), and for each, the probable cause and the strongest supporting alert.

5. **Point to the next action.** The one read-only check that would confirm the proposed origin, and the single alert most worth investigating next.

Output format: an "INCIDENT MAP" — for each distinct incident: PROBABLE ORIGIN (+confidence), CAUSAL CHAIN, SUPPORTING ALERTS — followed by an UNEXPLAINED ALERTS list and a NEXT CHECK. Rank the origin hypothesis by confidence. Group to focus attention, never to suppress alerts.