Killing Alert Noise with Sigma

A 4% move on a tech stock is a Tuesday. On a utility, it is an earthquake.

My bot watches a list of instruments during the day and pings my phone when something moves. The first version had the obvious rule: alert when any instrument moves more than a flat 3% from yesterday's close.

The flat threshold has a fatal flaw, and you can guess it from the title: 3% means completely different things to different instruments. A volatile tech name crosses 3% casually, several times a month, and each ping teaches you to ignore the next one. Meanwhile a sleepy dividend stock could lurch 2.8%, a genuinely abnormal event for it, and stay under the threshold entirely. The alert fires on noise and sleeps through signal.

Alert fatigue is not a comfort problem. An alert you have learned to swipe away is worse than no alert, because you believe you are covered.

The fix: measure each instrument against its own normal

The statistics here are one line: take the instrument's last 20 daily returns and compute their standard deviation (sigma). That number IS the instrument's personality: what a normal day looks like, for it specifically.

Then the alert rule becomes: fire only when today's move is at least 2.5 times the instrument's own sigma, AND clears a 2% absolute floor.

Both legs earn their place:

• The sigma leg personalizes the gate. A 3% wobble on a quiet utility is many sigmas and fires. A 4% Tuesday on a volatile name is inside its normal band and stays silent. Same math, opposite outcomes, both correct.
• The absolute floor handles the degenerate case: an extremely calm instrument can have a tiny sigma, making a 0.8% drift "statistically abnormal". True, but nobody needs a phone buzz about 0.8%. Statistical significance and practical significance are different tests; require both.

And one honesty rule: with fewer than 10 daily returns of history, sigma is not trustworthy, so the code openly falls back to the flat threshold rather than pretending to a precision it does not have.

The core is exactly this small:

SIGMA_LOOKBACK = 20      # daily returns per instrument
SIGMA_MIN_RETURNS = 10   # below this, fall back to the flat floor
 
sigma = statistics.stdev(last_20_daily_returns)   # per instrument
abnormal = (abs(move_pct) >= 2.5 * sigma
            and abs(move_pct) >= 2.0)             # both legs required

Plus a dedupe: one alert per instrument per day. The market re-crossing a threshold six times must not become six buzzes.

The test that proves the silence

The suite has a test I am genuinely fond of, because it asserts NOTHING happens: a +5% move on a high-volatility instrument, and the expected outcome is silence. Most tests prove the system acts; noise-killing work needs tests that prove the system correctly declines to act. (It once "failed" against a database carrying real market history, because the real volatility said the move was actually normal. The gate was right and my test fixture was wrong, which is the most reassuring way a test can fail.)

This is a monitoring lesson wearing a trading costume

Nothing above is about markets. Flat thresholds on heterogeneous populations generate noise, full stop. A fixed "CPU above 80%" alarm on a fleet where one box idles at 20% and another lives happily at 85% has the identical disease, and "alert when metric deviates N sigmas from ITS OWN baseline" is the identical cure. My phone used to buzz for Tuesdays; now it buzzes for earthquakes. Baseline per subject, gate on deviation from that baseline, keep an absolute floor for common sense, and write at least one test that proves the silence.

Pictures to add later

1. The Telegram mover alert showing the sigma multiple and volume context
2. Optional: side-by-side day chart of a volatile name (+4%, silent) vs a quiet one (+3%, alerted)