How has site reliability engineering revealed hidden issues with early alerts?

[Emma_R]

Site reliability engineering is about preventing outages, but sometimes the most valuable lessons come from when things break. What's a specific, non-obvious metric or alert you've set up that gave you an early warning for a problem users hadn't even noticed yet?