groups:
  - name: slo-burn
    rules:
      - alert: SLOBurnRateFast
        expr: |
          (rate(service_request_errors_total[5m]) / rate(service_requests_total[5m])) >
          4 * (1 - 0.99)
        for: 5m
        labels:
          severity: critical
          team: devops
        annotations:
          summary: "Fast burn: 99% SLO breached"
          description: "Error budget burn (5m) exceeds fast threshold."
      - alert: SLOBurnRateSlow
        expr: |
          (rate(service_request_errors_total[1h]) / rate(service_requests_total[1h])) >
          1 * (1 - 0.99)
        for: 1h
        labels:
          severity: warning
          team: devops
        annotations:
          summary: "Slow burn: 99% SLO at risk"
          description: "Error budget burn (1h) exceeds slow threshold."
  - name: slo-webhook
    rules:
      - alert: SLOWebhookFailures
        expr: rate(slo_webhook_failures_total[5m]) > 0
        for: 10m
        labels:
          severity: warning
          team: devops
        annotations:
          summary: "SLO webhook failures"
          description: "Webhook emitter has failures in last 5m."