In today's complex IT environments, managing the vast number of metrics, alerts, and anomalies can be overwhelming. IT operations teams need a comprehensive approach that not only detects issues but also provides actionable insights. This is where ServiceNow's powerful integration of anomaly detection, Metric Intelligence (MI), and Now Assist comes into play, revolutionizing how we handle IT operations.
Connecting the Dots: From Metrics to Insights
In this example, we configured an agent to collect multiple metrics across different systems. The agent is set to trigger alerts when a specific threshold of anomalies is met—specifically, when more than five anomalies occur within a five-minute window on the same Configuration Item (CI). Once this threshold is crossed, the system automatically promotes these anomalies into alerts.
By grouping related alerts, we simplify the flood of information into more manageable and actionable insights. For instance, in scenarios where multiple metrics such as CPU load, memory availability, and cache performance become anomalous on the same CI, the system consolidates them into a single group of alerts, giving a clearer picture of the underlying issue.
Metrics dashboard showing multiple metrics from different sources being visualized in ServiceNow Service Operations Workspace
Unified Alert Correlation with Metric Intelligence
What sets this approach apart is how Metric Intelligence (MI) and Now Assist seamlessly work together. Once the system groups the alerts, Now Assist—powered by ServiceNow's Generative AI engine—analyzes the underlying causes and identifies correlations between different metrics. Instead of separate alerts for each metric, Now Assist consolidates them into a single, more manageable message. This human-readable format simplifies the analysis, allowing operators to quickly understand the root cause and recommended next steps.
This analysis is particularly useful for customers who prefer not to define static thresholds for every metric but react only when significant patterns emerge. The system not only groups the alerts but also provides a deeper understanding of how they are interrelated, leading to quicker and more accurate resolutions.
Alert group of multiple anomalies
Now Assist groups anomalies into one alert and provides a human-readable summary of the incident
Integration with Third-Party Tools: A Case for Dynatrace
A significant capability of this system is its ability to integrate with third-party tools like Dynatrace. In this example, we simulated a load on a machine monitored by both the ServiceNow agent and the Dynatrace agent. By enabling anomaly detection for Dynatrace, we collected data, detected anomalies, and visualized them on the same platform as our internal metrics.
What makes this integration especially powerful is that the metrics from Dynatrace are processed entirely within our Metric Intelligence (MI) engine. MI builds models, detects anomalies, and promotes them to alerts—without requiring any additional configuration or processing from Dynatrace's side. This broader coverage allows us to dynamically detect anomalies across multiple metrics.
This cross-platform correlation is invaluable. While Dynatrace might only detect a CPU issue, our system revealed multiple related metrics—such as memory and cache—becoming anomalous. This broader view gives a fuller, more accurate picture of the system’s health. With Now Assist, these alerts are intelligently grouped and analyzed, resulting in a consolidated, human-readable message. The ability to detect and group multiple anomalies across different metrics provides far more meaningful insights than isolated alerts from a single source, underscoring the added value of ServiceNow on top of existing third-party monitoring tools.
Both Dynatrace and internal metrics being processed and visualized on a single platform to show cross-platform correlation.
Visualizing the Data: A Powerful Aid for Operators
ServiceNow's Now Assist takes this a step further by providing visual representation of the anomaly data. The system displays metrics from multiple sources—both internal and third-party—on a unified interface. For example, when data from both ServiceNow’s ITOM agent and Dynatrace is ingested, anomalies are grouped and visualized clearly. Operators can drill down into individual alerts to see detailed metrics, helping to prevent future issues by recognizing patterns.
Detailed view of how operators can drill down into alerts and visualize correlated metrics.
Looking Ahead: Enhanced Grouping and Correlation in Future Releases
In upcoming releases, we are improving the way group headers are defined to make them more meaningful and less random. Currently, the system may pick one alert to represent the entire group, but future updates will ensure that the header reflects the true nature of the issue.
As we continue to refine these capabilities, customers can expect even more precise and actionable insights from their anomaly detection systems, leading to faster resolutions and a more proactive approach to IT operations.
Conclusion: The Future of IT Operations
ServiceNow’s integration of Metric Intelligence and Now Assist provides a powerful solution for IT operations teams. It enables faster issue resolution by providing clearer insights and visualizing data across multiple platforms. Whether integrating with internal metrics or third-party tools like Dynatrace, this unified approach to anomaly detection and alert management offers a comprehensive, proactive way to manage complex IT environments.
By connecting all the dots—metrics, anomalies, alerts, and analysis—this system not only helps identify problems but also equips teams with the tools to resolve them efficiently. As we continue enhancing these capabilities, IT operations are set to become even more streamlined and effective.
Kindly take a moment to review the following video, which demonstrates how these capabilities come together in action.
1 Comment
