A method in a cloud infrastructure of multi-level threshold service level agreement (SLA) violation mitigation, the method comprising: generating a model for an engineered feature (eF), wherein the eF is based on collected metrics; determining a first threshold T1, a second threshold T2, and a maximum threshold Tε for the eF based on the generated model of the eF; estimating at a predetermined frequency a value of the eF based on real-time metrics; responsive to determining that the value of the eF exceeds Tε, adjusting the values of T1 and T2 and modifying the estimation frequency and sending to a cloud orchestrator a message indicating that an SLA violation of type Tε has occurred; responsive to determining that the value of the eF does not exceed Tε, determining whether the value of eF exceeds T1; responsive to determining that the value of eF exceeds T1, determining whether the change in rate of eF (eF') has been positive; responsive to determining that the change in rate of eF has been positive, determining whether the value of eF exceeds T2; responsive to determining that the value of eF exceeds T2, determining whether the change in the rate of eF' (eF") exceeds a value1; responsive to determining that the value of eF" exceeds the value1, triggering a SLA violation warning of type value1; responsive to determining that the value of eF does not exceed T2, determining whether the change in the rate of eF' exceeds a value2; responsive to determining that the value of eF" exceeds the value2, triggering a SLA violation warning of type value2; responsive to a SLA violation warning being triggered, determining one or more elements of the eF that triggered the SLA violation warning; and sending to the cloud orchestrator a message indicating the one or more elements. generating a model for an engineered feature (eF), wherein the eF is based on collected metrics; determining a first threshold T1, a second threshold T2, and a maximum threshold Tε for the eF based on the generated model of the eF; estimating at a predetermined frequency a value of the eF based on real-time metrics; responsive to determining that the value of the eF exceeds Tε, adjusting the values of T1 and T2 and modifying the estimation frequency and sending to a cloud orchestrator a message indicating that an SLA violation of type Tε has occurred; responsive to determining that the value of the eF does not exceed Tε, determining whether the value of eF exceeds T1; responsive to determining that the value of eF exceeds T1, determining whether the change in rate of eF (eF') has been positive; responsive to determining that the change in rate of eF has been positive, determining whether the value of eF exceeds T2; responsive to determining that the value of eF exceeds T2, determining whether the change in the rate of eF' (eF") exceeds a value1; responsive to determining that the value of eF" exceeds the value1, triggering a SLA violation warning of type value1; responsive to determining that the value of eF does not exceed T2, determining whether the change in the rate of eF' exceeds a value2; responsive to determining that the value of eF" exceeds the value2, triggering a SLA violation warning of type value2; responsive to a SLA violation warning being triggered, determining one or more elements of the eF that triggered the SLA violation warning; and sending to the cloud orchestrator a message indicating the one or more elements. <EOS>