---
sourceDocument: Brazil Telecommunications Service Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/telecom-service-ops

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Telecommunications Service Operations Management

ft:clusterId :

    - tsom

bundleId :

    - tsom

workflow :

    - Customer and Industry


---

# Configure an anomaly alert for an MPN data input

# Configure an anomaly alert for an MPN data input {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure a log anomaly alert for a Mobile Private Network (MPN) data input that generated its own source type.

## Before you begin

You created a data input and, if applicable, a source type, as described in [Configure security log collection for MPN](https://www.servicenow.com/docs/QUwuW99V4QrvA7iMOs99gg "Configure the out-of-box Health Log Analytics security log data input, an Elasticsearch collector, to collect Mobile Private Network (MPN) security logs and convert them into structured log records.").

Role required: tsom_assurance_admin

## About this task

An anomaly alert is configured for the out-of-box MPN source type and fires on Major-severity `ERROR` events with no aggregation window. If your
data input generated its own source type, configure a matching alert for it.{#configure-anomaly-alert-for-new-mpn-data-input__configure-anomaly-alert-for-new-mpn-data-input-context-1}

## Procedure

1. Navigate to Health Log AnalyticsLog Anomaly DetectionDefine Alert and select Create Alert.
2. Select the index corresponding to the data input and source type pairing you configured.
3. Define the filter or query for the condition to detect.  
   For example, specify a severity or field value. Use the Lexical Keywords, Metrics Threshold Raises, or Advanced Log Alert Filter related lists if a simple filter is not sufficient.
4. Set the trigger thresholds, then set the alert severity, name, and description.  
   Trigger thresholds include the number of matches, time period, and consecutive periods.
5. Activate the alert and validate it with a test event.  
   Use Muted Metrics to temporarily suppress noisy conditions while you tune the alert.
{#configure-anomaly-alert-for-new-mpn-data-input__steps_zcd_qsn_lkc}

*[\>]: and then