One of our three most problematic testing areas, and similar to the large effort around completing/refining disruption testing, similar effort is needed around alerting.

There appear to be two parallel stacks of testing, one that uses a hardcoded list of what to ignore, one that uses historical data from bigquery for what to allow. (similar to disruption)

Eliminate one of the two paths, refine and test the other, explore the data in bigquery, make sure it's logical and usable.