Create an Insight Rule

Prerequisites

Before creating Insight Rules, ensure the following conditions are met:

Data availability

• Historical spend or usage data is uploaded or ingested into the platform.

• Data is continuous and consistent, with no significant gaps or missing periods.

• The available data range aligns with the requirements of the selected detection method.

Data accuracy

• Uploaded files (such as spend, usage, or cloud consumption) are validated and mapped correctly.

• Currency conversions, account mappings, and master data configurations are set up properly.

• Data values accurately reflect actual spend or usage to ensure meaningful anomaly detection.

Sufficient historical range

• Sufficient historical data exists to establish a reliable baseline.

• For seasonal detection (for example, using Prophet), at least one full seasonal cycle (such as a month or quarter) of data is recommended.

Configured dimensions

• Required dimensions (such as services, applications, business units, or accounts) are properly configured.

• At least one data cube (Spend Cube or Cloud Cube) is active and available for monitoring.

Rule setup

• You have identified the metric to monitor (such as spend, budget, or variance).

• You understand the anomaly category and detection method appropriate for your data behavior.

• Notification groups are configured with recipients (Email, Microsoft Teams, or Slack). For more information on how to configure Notification Channel Groups, refer Set up notification channel group.

Checklist for creating Insight Rules

Use this checklist to ensure your Insight rules are accurate, actionable, and generate meaningful signals instead of noise.

• Assess data behavior

  • Identify the volatility level of the data.

  • Confirm whether recurring or seasonal patterns are present.

  • Determine if baseline shifts or structural changes are expected.

• Select the right detection method

  • Match the detection method to data volatility and seasonality.

  • Verify that data meets the method’s prerequisites.

  • Favor interpretable methods for business-facing insights.

• Define a clear scope

  • Apply dimensions to focus on critical services, accounts, or units.

  • Avoid overly broad rules that generate excessive alerts.

• Set meaningful thresholds

  • Align thresholds with real business impact.

  • Avoid overly sensitive settings that lead to false positives.

• Configure notifications thoughtfully

  • Ensure alerts reach the right teams and owners.

  • Use severity levels to support prioritization and response.

• Test and refine

  • Validate rules against known historical events.

  • Adjust scope, thresholds, or detection methods as data patterns evolve.

Create an Insight rule

Procedure

Follow these steps to create a rule for detecting anomalies in your cost or usage data:

1. Navigate to Admin > Insights Rules.

2. Click + CREATE RULE.

3. On New Insight Rule popup, fill in the rule details.

   1. Rule name: Provide a clear, descriptive name for your rule.

   2. Description: Add a summary of what this rule is intended to detect.

4. In the Rule Configuration, select:

   1. Insight Type: Select the type of insight, for example, Anomaly - Detect unusual patterns.

   2. Data Source: Choose the cube where anomalies should be detected.

      1. Spend Cube View: Use this when you want to analyze anomalies in overall IT spend, cost allocation, budgets, and chargeback-related metrics.

      2. Cloud Cube View: Use this when you want to analyze anomalies in cloud usage and billing data, such as service-level costs, usage metrics, or commitment discounts.

         

   3. Detection Method: Pick the detection method suited for your use case.

   4. Metric: Select the metric to be monitored for the insights, for example, Spend, Budget, or Variance.

5. In Dimensions,

   1. Click + to add a dimension to scope the rule to specific attributes from the cube. For spend cube, the dimensions could be Account, Cost Center, Vendor, Tower, and so on. For the cloud cube, they can be Provider, Region, Service, and so on.

      

   2. Select a dimension value. It is the actual dimension value within that cube. The rule will only monitor anomalies or thresholds for this value.

6. In Thresholds,

   1. Click + to define thresholds to control when alerts should be triggered. Each threshold requires:

      1. Severity – Choose the impact level (Critical, High, Medium, or Low).

      2. Operator – Select the condition, for example, greater than, less than, equal to.

      3. Value – Enter the numeric value that represents the threshold limit.

         

7. In Notifications,

   1. Click + to add a notification to configure how you want to be notified when the rule is triggered, for example, Email, Microsoft Teams, or Slack.

      1. Type: Choose Email, Microsoft Teams, or Slack.

      2. Recipient Groups: Select a one or more group recipient(s).

8. In Processing Configuration,

   1. Frequency: Select how often the rule should run (daily, hourly, weekly, or monthly).

   2. Cooldown Days: Define the cooldown period (in days) to prevent duplicate alerts for the same anomaly. The default is 7 days.

      

9. Click SAVE.

Once saved, the rule runs automatically at the selected frequency. If the detection criteria are met, alerts are triggered and the resulting Insights appear on the Insights page.

Related content

Manage Insights Rules

Insights Rules | Anomaly detection methods

Set up notification channel group

Configure Notification Channels

Get Incoming Webhooks URL for Microsoft Teams and Slack