First of all, what is a false positive?
A false positive is an alert, which after investigation, turns out to be a false alarm; an alert that is triggered when the monitored device is, in fact, operating as expected.
What are the impacts of false positives?
To understand the impact of false positives on an organization, one must look at the activities undertaken when processing an alert.
Consider an example from one of our customers:
- An alert occurs on the monitoring dashboard
- The person responsible for monitoring will receive the alert and open a ticket thanks to the integration with his ticketing tool, qualify it in his ITSM and assign it to the correct resolution group. Time of the operation: 3 min
- The technician in charge of resolving the incident will be notified of the arrival of a new ticket, take ownership of it, check the monitoring platform (with a little luck, the false positive has returned to the OK state, he can close the ticket), analyze the error message raised in the monitoring, connect to the target device and make the necessary investigations, …. and finally conclude it to be a false positive. This observation will result in a modification of the current monitoring configuration, closure of the ticket, and a return of the check to the OK state.
Incident finished, let’s move on to the next ….
Total time of the operation: between 20 and 30 min, 2 people affected.
Cost of the operation: around 20 €
Imagine 20 false positives a day… that cost could be equivalent to 1 full time employee!!
What solutions are there to limit false positives?
In ServiceNav, we implemented several solutions to limit false positives and allow teams to focus on real service impacting events:
- customisable thresholds for each service
- Additional checks for each host and service
- A report to target the elements that trigger the most alerts
And as the ad would say: “And it’s not over…”
In the coming months, thanks to our BigData stack implemented since version 4.0, we will come forward with further innovative solutions to reduce false positives.