Create an Insight Rule

Prerequisites

Before creating Insight Rules, ensure the following conditions are met:

Data availability

• Historical spend or usage data is uploaded or ingested into the platform.

• Data is continuous and consistent, with no significant gaps or missing periods.

• The available data range aligns with the requirements of the Z-score detection method.

Data accuracy

• Uploaded files (such as spend, usage, or cloud consumption) are validated and mapped correctly.

• Currency conversions, account mappings, and master data configurations are set up properly.

• Data values accurately reflect actual spend or usage to ensure meaningful anomaly detection.

Sufficient historical range

• Sufficient historical data exists to establish a reliable baseline.

• Historical data should represent normal spending or usage patterns so that unusual behavior can be identified accurately.

Configured dimensions

• Required dimensions (such as services, applications, business units, or accounts) are properly configured.

• At least one supported data cube is active and available for monitoring, such as Spend Cube View, Cloud Cube View, or AI Cube View.

Rule setup

• You have identified the metric to monitor (such as spend, budget, or variance).

• You understand the anomaly category and detection method appropriate for your data behavior.

• Notification groups are configured with recipients (Email, Microsoft Teams, or Slack). For more information on how to configure Notification Channel Groups, refer Set up notification channel group.

Checklist for creating Insight Rules

Use this checklist to ensure your Insight rules are accurate, actionable, and generate meaningful signals instead of noise.

• Assess data behavior

  • Identify the volatility level of the data.

  • Confirm whether recurring or seasonal patterns are present.

  • Determine if baseline shifts or structural changes are expected.

• Define a clear scope

  • Apply dimensions to focus on critical services, accounts, or units.

  • Use multi-value selection within dimensions to cover related values (for example, multiple providers or regions) in a single rule instead of creating duplicates.

  • Avoid overly broad rules that generate excessive alerts.

• Set meaningful thresholds

  • Align thresholds with real business impact.

  • Avoid overly sensitive settings that lead to false positives.

• Configure notifications thoughtfully

  • Ensure alerts reach the right teams and owners.

  • Use severity levels to support prioritization and response.

• Test and refine

  • Validate rules against known historical events.

  • Adjust scope, or thresholds as data patterns evolve.

Create an Insight rule

Procedure

Follow these steps to create a rule for detecting anomalies in your cost or usage data:

1. Navigate to Admin > Insights Rules.

2. Click + CREATE RULE.

3. On New Insight Rule popup, fill in the rule details.

   1. Rule name: Provide a clear, descriptive name for your rule.

   2. Description: Add a summary of what this rule is intended to detect.

4. In the Rule Configuration, select:

   1. Insight Type: Select the type of insight, for example, Anomaly - Detect unusual patterns.

   2. Data Source: Choose the cube where anomalies should be detected.

      1. Spend Cube View: Use this when you want to monitor supported measures across Spend models, including Spend, Budget, Forecast, available Variance measures, and measures from custom Spend models. The Spend Cube View frequency is monthly.

      2. Cloud Cube View: Use this when you want to analyze anomalies in cloud usage and billing data, such as service-level costs, usage metrics, or commitment discounts. The cloud cube’s available frequencies are hourly, daily, weekly, and monthly.

         

      3. AI Cube View: Use this when you want to monitor AI Consumption spend directly. AI Cube View supports Spend (Billed Cost) and AI consumption dimensions including Provider, Region Name, Billing Account Name, Sub Account Name, Service Category, and Service Name. Available frequencies are hourly, daily, weekly, and monthly.

   3. Detection Method: Pick the detection method suited for your use case.

   4. Metric: Select the measure you want the rule to monitor. When Data Source is set to Spend Cube View, available measures are grouped by model. Depending on the models configured in your environment, you can select measures from Budget, Forecast, Spend, custom Spend models, and available Variance measures. When Data Source is set to AI Cube View, the currently supported metric is Spend, which represents billed AI consumption cost.

      

5. In Dimensions,

   1. Click + to add a dimension to scope the rule to specific attributes from the selected cube. For Spend Cube View, dimensions can include Account, Cost Center, Vendor, Tower, and other supported model dimensions. For Cloud Cube View, dimensions can include Provider, Region, Service, and other supported cloud dimensions. For AI Cube View, supported dimensions are Provider, Region Name, Billing Account Name, Sub Account Name, Service Category, and Service Name.

      

   2. Select a dimension value. It is the actual dimension value within that cube. The rule will only monitor anomalies or thresholds for this value.

Monitor measures across Spend models

With Spend Cube View, an Insight Rule can monitor supported measures from multiple Spend models.

You can create rules to monitor:

• actual Spend,

• Budget,

• Forecast,

• available Variance measures, and

• measures from custom Spend models, including AI Spend models where available.

The available measures depend on the models and data configured in your environment. Each rule monitors the specific measure selected in Metric.

Monitor AI Consumption spend

Use AI Cube View to create Insight Rules directly against AI Consumption spend.

The initial implementation supports:

For example, you can create a daily Insight Rule for Spend, filter it to a Service Category such as AI and Machine Learning, and use Z-Score thresholds to detect unusual AI cost patterns.

6. In Thresholds,

   1. Click + to define thresholds to control when alerts should be triggered. Each threshold requires:

      1. Severity – Choose the impact level (Critical, High, Medium, or Low).

      2. Operator – Select the condition, for example, greater than, less than, equal to.

      3. Value – Enter the numeric value that represents the threshold limit.

         

7. In Notifications,

   1. Click + to add a notification to configure how you want to be notified when the rule is triggered, for example, Email, Microsoft Teams, or Slack.

      1. Type: Choose Email, Microsoft Teams, or Slack.

      2. Recipient Groups: Select a one or more group recipient(s).

8. In Processing Configuration,

   1. Frequency: Select how often the rule should run (daily, hourly, weekly, or monthly).

   2. Cooldown Days: Define the cooldown period (in days) to prevent duplicate alerts for the same anomaly. The default is 7 days.

      

9. Click SAVE.

Related content

• Manage, import, and export Insights Rules

• Insights Rules

• Set up notification channel group

• Configure Notification Channels

• Get Incoming Webhooks URL for Microsoft Teams and Slack