getsentry / getsentry/sentry

Ability to detect and alert on unexpected organization-wide usage spikes

Open
#119,672 3 comments 0 reactions 0 assignees View on GitHub
Feature Product Area: Alerts Waiting for: Product Owner
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
21h 10m
Merged PRs (30d)
635

Description

### Problem Statement

We need a way to get alerted when the overall organization usage suddenly spikes, not just when a single project crosses a quota threshold.

Sentry already has a mechanism through billing notifications, which fire on fixed percentage-of-quota-consumed thresholds (80%/100%). This is a lagging signal tied to billing consumption rather than true anomaly detection. Genuine anomaly-detection and percent-change metric alerts exist in Sentry today, but are scoped to a single project, with no mechanism to apply that detection logic across aggregated, multi-project, or org-wide volume.

A volume spike in a single service can currently go undetected at the organization level until it registers against a billing threshold, by which point quota has often already been consumed.

### Solution Brainstorm

- Support for detecting unexpected spikes in aggregate volume across all projects in an organization, not just a single project. This doesn't need to be limited to Sentry's existing "Anomaly Detection" alert type specifically — percent-change thresholds, static thresholds, or other spike-detection methods evaluated at the org level would also address this.
- Where possible, reuse existing detection approaches (e.g., dynamic/learned thresholds) but applied at the org level rather than per-project.
- Alert latency fast enough to surface spikes same-day, rather than after a multi-day delay.

### Product Area

Other

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by reviewing the existing project-scoped anomaly detection and billing notification mechanisms, then determine how organization-wide aggregation and same-day alerting should work; done means unexpected aggregate volume spikes across an organization can trigger alerts.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.