# Give preview dynamic PromQL alerts a numeric signal instead of a Boolean test

> What should a PromQL expression return when its alert threshold will be learned dynamically?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-397-give-preview-dynamic-promql-alerts-a-numeric-signal-instead-of-a-boolean-test/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:25:19+00:00
- Modified: 2026-09-10T02:01:57+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

What should a PromQL expression return when its alert threshold will be learned dynamically?

## Potentially affected

Azure Monitor query-based metric alerts using preview dynamic thresholds with PromQL expressions.

## DSE recommendation

Review the expression's output contract before selecting dynamic sensitivity or investigating alert noise.

## Article

## Source facts

Dynamic thresholds for Azure Monitor query-based metric alerts are preview functionality. They evaluate PromQL expressions against managed Prometheus or OTel metrics in an Azure Monitor workspace. Microsoft advises returning numeric measurements rather than Boolean comparisons: calculate CPU usage instead of embedding a CPU threshold comparison in the expression. The configured condition is met when the expression’s value crosses the dynamically calculated threshold. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-dynamic-thresholds).

## Applicability

This concerns the input contract of a preview query-based metric alert, not a promise that any particular anomaly will be detected. Start with the measurement the operator actually needs to distinguish.

## DSE recommendation

Review the expression’s output contract before selecting dynamic sensitivity or investigating alert noise. Ask the rule owner to explain the units, aggregation and intended meaning of each returned series. Keep the measured quantity separate from the decision boundary. When adapting a query used elsewhere as a fixed pass/fail check, explicitly reconsider that comparison rather than copying it unchanged into the dynamic rule.

## Verification

Run the proposed expression over a representative approved time range and inspect its numerical results. Compare the preview chart with those same measurements and identify where the dynamic bounds sit relative to them. Document any intentional differences from the previous fixed-threshold rule. Treat a readable preview as validation of the query’s intended input, not as evidence that future incidents are covered or that production notification paths were tested.

## Official references

[Microsoft Learn: Dynamic alert thresholds](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-dynamic-thresholds). Source reviewed September 9, 2026.

## Primary reference

- Name: Create a Log Search alert rule with dynamic threshold - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-dynamic-thresholds
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Give preview dynamic PromQL alerts a numeric signal instead of a Boolean test,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-397-give-preview-dynamic-promql-alerts-a-numeric-signal-instead-of-a-boolean-test/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.