Create an Insight Rule

Prerequisites

Before creating Insight Rules, ensure the following conditions are met:

Data availability

• Historical spend or usage data is uploaded or ingested into the platform.

• Data is continuous and consistent, with no significant gaps or missing periods.

• The available data range aligns with the requirements of the Z-score detection method.

Data accuracy

• Uploaded files (such as spend, usage, or cloud consumption) are validated and mapped correctly.

• Currency conversions, account mappings, and master data configurations are set up properly.

• Data values accurately reflect actual spend or usage to ensure meaningful anomaly detection.

Sufficient historical range

• Sufficient historical data exists to establish a reliable baseline.

• Historical data should represent normal spending or usage patterns so that unusual behavior can be identified accurately.

Configured dimensions

• Required dimensions (such as services, applications, business units, or accounts) are properly configured.

• At least one data cube (Spend Cube or Cloud Cube) is active and available for monitoring.

Rule setup

• You have identified the metric to monitor (such as spend, budget, or variance).

• You understand the anomaly category and detection method appropriate for your data behavior.

• Notification groups are configured with recipients (Email, Microsoft Teams, or Slack). For more information on how to configure Notification Channel Groups, refer https://yarken.atlassian.net/wiki/x/E4ADLg.

Checklist for creating Insight Rules

Use this checklist to ensure your Insight rules are accurate, actionable, and generate meaningful signals instead of noise.

• Assess data behavior

  • Identify the volatility level of the data.

  • Confirm whether recurring or seasonal patterns are present.

  • Determine if baseline shifts or structural changes are expected.

• Define a clear scope

  • Apply dimensions to focus on critical services, accounts, or units.

  • Use multi-value selection within dimensions to cover related values (for example, multiple providers or regions) in a single rule instead of creating duplicates.

  • Avoid overly broad rules that generate excessive alerts.

• Set meaningful thresholds

  • Align thresholds with real business impact.

  • Avoid overly sensitive settings that lead to false positives.

• Configure notifications thoughtfully

  • Ensure alerts reach the right teams and owners.

  • Use severity levels to support prioritization and response.

• Test and refine

  • Validate rules against known historical events.

  • Adjust scope, or thresholds as data patterns evolve.

Create an Insight rule

Procedure

Follow these steps to create a rule for detecting anomalies in your cost or usage data:

1. Navigate to Admin > Insights Rules.

2. Click + CREATE RULE.

3. On New Insight Rule popup, fill in the rule details.

   1. Rule name: Provide a clear, descriptive name for your rule.

   2. Description: Add a summary of what this rule is intended to detect.

4. In the Rule Configuration, select:

   1. Insight Type: Select the type of insight, for example, Anomaly - Detect unusual patterns.

   2. Data Source: Choose the cube where anomalies should be detected.

      1. Spend Cube View: Use this when you want to analyze anomalies in overall IT spend, cost allocation, budgets, and chargeback-related metrics. The spend cube's available frequency is monthly.

      2. Cloud Cube View: Use this when you want to analyze anomalies in cloud usage and billing data, such as service-level costs, usage metrics, or commitment discounts. The cloud cube’s available frequencies are hourly, daily, weekly, and monthly.

         

   3. Detection Method: Pick the detection method suited for your use case.

   4. Metric: Select the metric to be monitored for the insights, for example, Spend, Budget, or Variance.

5. In Dimensions,

   1. Click + to add a dimension to scope the rule to specific attributes from the cube. For spend cube, the dimensions could be Account, Cost Center, Vendor, Tower, and so on. For the cloud cube, they can be Provider, Region, Service, and so on.

      

   2. Select a dimension value. It is the actual dimension value within that cube. The rule will only monitor anomalies or thresholds for this value.

6. In Thresholds,

   1. Click + to define thresholds to control when alerts should be triggered. Each threshold requires:

      1. Severity – Choose the impact level (Critical, High, Medium, or Low).

      2. Operator – Select the condition, for example, greater than, less than, equal to.

      3. Value – Enter the numeric value that represents the threshold limit.

         

7. In Notifications,

   1. Click + to add a notification to configure how you want to be notified when the rule is triggered, for example, Email, Microsoft Teams, or Slack.

      1. Type: Choose Email, Microsoft Teams, or Slack.

      2. Recipient Groups: Select a one or more group recipient(s).

8. In Processing Configuration,

   1. Frequency: Select how often the rule should run (daily, hourly, weekly, or monthly).

   2. Cooldown Days: Define the cooldown period (in days) to prevent duplicate alerts for the same anomaly. The default is 7 days.

      

9. Click SAVE.

Related content

• Manage, import, and export Insights Rules

• Insights Rules

• Set up notification channel group

• Configure Notification Channels

• Get Incoming Webhooks URL for Microsoft Teams and Slack