This document discusses IT service intelligence (ITSI) concepts including defining services, key performance indicators (KPIs), service health scores, and service decomposition. A service can include multiple technology components and tiers that need to be monitored together from a user's perspective. KPIs are Splunk searches that monitor specific metrics like CPU or errors. Health scores from 0-100 indicate a service's status based on KPI status and importance. Entities that support services can come from CMDBs or searches. Services can be decomposed into sub-services and underlying processes to define relevant KPIs for monitoring. Adaptive thresholding and anomaly detection help determine normal vs abnormal behavior in dynamic or patterned data. ITSI allows