Smart Alerts for ServiceNow

How to Reduce False-Positive Smart Alerts

There's significant variation in how organizations use SaaS applications, so one Smart Alert rule is rarely effective for everyone.

Detecting unexpected deletion is generally the most effective uses of Smart Alerts, with the fewest false positives. For your tables that should be watched, it is best to set a Smart Alert for at least 25% of records being deleted or setting a specific number of records being deleted.

There are several factors that can contribute to false positives in Smart Alerts, resulting in noise and alert fatigue. Configuring a percentage change threshold on tables with fewer than 150 records has a high false-positive rate because small changes equate to a high percentage change.

For many SaaS applications, it can be difficult to discern between normal versus abnormal inserts and updates. An effective solution can be to set Smart Alerts with a high threshold value of inserts and updates on tables that have high risk of corruption, such as active integrations and frequent changes.

Metadata Smart Alerts

Configuring Smart Alerts on metadata changes can proactively detect unwanted modifications to the SaaS schema.

When are Statistical Outlier Smart Alerts Useful

The definition of a Smart Alert statistical outlier assumes a normal pattern of use around a baseline that is not zero. To avoid high false positive rates, statistical outlier Smart Alerts are only applied when fit-for-purpose. Specifically, a table that shows a normal distribution of modifications over time is a candidate for the statistical outlier Smart Alert. Another appropriate use is if you expect little or no change in a table over time, then the statistical outlier alert will trigger on a change of any magnitude.