AIOps Configuration

Adaptive Thresholds

These dynamic, model-generated values define acceptable upper and lower bounds for system metrics hourly. These thresholds are not fixed like traditional static thresholds (e.g., CPU > 80%) but are derived from 30 days of historical data to predict the expected range of values for the next three weeks. The model calculates and maintains three key values for each hour: lower bound, upper bound, and median value.

Example:

The model learns this trend for a router port with low typical usage on Mondays at 11 AM. If a sudden spike is observed at that same hour, it will flag it as an anomaly based on the trained range threshold, not a hardcoded static rule.

Add or Configure Range Thresholds

• Go to Infraon Configuration -> IT Operations-> Threshold

• Click on 'Add' and select 'Protocol' as desired.

Please refer to the product documentation for guidance on adding Basic threshold types.

Model-Based Thresholding

• The system requires 30 days of historical data to analyze usage trends.

• Once enough data is available, the model generates hourly range values for the next 2 weeks.

• For each hour, the model calculates:

  • Lower bound

  • Upper bound

  • Median value

• These values are collectively known as the Range Threshold and are used for anomaly detection.

Add Range | Basic Details

Label	Action	Description / Example
Severity	Select the severity level.	Choose the alert severity (e.g., Minor, Major, Critical) to define the threshold range for each level.
Condition	Select from the drop-down	Defines the condition type. Options include: · Greater Than or Equal To (≥) · Less Than or Equal To (≤)
Value	Enter a numeric value	Specify the threshold value to compare against the monitored metric. Example: 100000000.
Poll Points	Enter a numeric value.	Number of polling intervals (data points) to be considered for evaluating the condition. Example: 10
Breached (%)	Enter a percentage value	Percentage of poll points that must breach the defined value to trigger an alert. Example: 60%
Effective Poll Points	Auto-calculated (read-only)	The actual number of poll points that need to breach the threshold. Calculated as: Poll Points × Breach% Example: 10 poll points × 60% = 6 effective poll points.

Enabling Adaptive Thresholds

• In the configuration UI for Advanced Resource Configuration, toggle Prediction and set the necessary statistical inputs.

• The system will apply the model-generated thresholds automatically.

• These thresholds adjust for:

  • Time of day (e.g., weekday vs weekend behavior)

  • Device-specific patterns

  • Location-specific variations

Threshold Sensitivity (Factor Configuration)

• You can optionally define severity levels (e.g., Minor, Major, Critical) based on how much the live value deviates from the predicted range.

• The formula used:

  • Threshold = Model Value ± (Factor × Deviation)

  • For example, if the predicted upper band is 70 and the factor is 1 with a margin of 20, the threshold would extend to 90.

• This helps adjust thresholds based on how aggressively you want to treat deviations as anomalies.

Adaptive Threshold | Basic Details

Label	Action	Description / Example
Severity	Select the severity level.	Define the alert severity (e.g., Minor, Major, Critical) to configure threshold behavior accordingly for each level.
Factor	Enter a numeric value	Multiplier used to scale the deviation from the model’s predicted value. It determines how sensitive the threshold is. Example: If the predicted value is 70 and the deviation is 10, a factor of 1.5 means the threshold will be set at 70 ± (1.5 × 10) = 55 to 85.
Upper Band	Enter the factor and alert above value.	Upper Band: Specifies how many times above the predicted upper bound the breach should be considered. Alert Above: A fallback value above which a breach is triggered.
Lower Band	Enter the factor and alert below the value.	Lower Band: Defines how many times below the predicted lower bound a value must fall to trigger a breach. Alert Below: The fallback value below is where the breach applies.
Poll Points	Enter a numeric value.	The number of polling intervals (data points) to evaluate for the defined severity level.
Breached (%)	Enter a percentage value	The percentage of poll points must breach the threshold to raise an alert.

Customizations Available:

• You can choose which threshold bands to apply: Upper only, Lower only, or Both.

• Configure point tolerance by specifying how many consecutive breaches (e.g., 3 out of 5 poll points) should trigger an alert.

Usage in Real-Time Monitoring:

• During live monitoring, the system compares each polled value against the model's predicted upper and lower thresholds.

• An anomaly event is generated if a value falls outside the defined range.

• The anomaly event can automatically create a ticket if a corresponding trigger is configured.

• Threshold models are retrained weekly to adapt to the latest usage patterns.