Define metric math expressions in GetMetricData API calls using the 'MetricDataQueries' array; each query is either a raw metric ('MetricStat') or a math expression ('Expression') referencing other query IDs
Use metric math functions such as ANOMALY_DETECTION_BAND, FILL, RATE, SUM, AVG, and IF to compute derived signals; reference other queries by their 'Id' field in expressions like 'SUM([m1, m2])'
Create a standard CloudWatch alarm via 'PutMetricAlarm' API (or aws cloudwatch put-metric-alarm CLI) specifying 'Metrics' array with math expressions for threshold-based alerting on computed values
Create a composite alarm via 'PutCompositeAlarm' API with 'AlarmRule' as a boolean expression combining existing alarm states: 'ALARM("alarm1") AND ALARM("alarm2")' or with OR/NOT operators
Set 'AlarmActions' and 'OKActions' to SNS topic ARNs for notifications; configure 'TreatMissingData' as 'breaching', 'notBreaching', 'ignore', or 'missing' to control alarm state during data gaps
Known gotchas
Composite alarms cannot directly reference metrics — they can only reference the state of other alarms; attempting to use a metric ARN in AlarmRule returns a validation error
Metric math expressions in alarms have a limit on the number of metrics and expressions per alarm; exceeding this limit requires splitting logic across multiple alarms composed with a composite alarm
CloudWatch alarms evaluate at a minimum period of 10 seconds (high-resolution) or 60 seconds (standard); the period must match the metric's resolution or the alarm may never receive data points
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp