Abstract: Embodiments of the present disclosure relate to a method for processing alerts. According to an embodiment of the present disclosure, a set of alerts matching a metric template are identified from received alerts during a period of time. A plurality of variable values are acquired from the set of alerts based on the metric template. The plurality of variable values are normalized according to a normalization rule of the metric template. A severity level for the set of alerts is determined based on the normalized variable values. In response to the severity level exceeding a certain threshold, an abstract alert including information related to the set of alerts is generated.