Network: capacity planning, среднее потребление трафика в крупной сети (throughput, CC, CPS); количество правил NGFW/firewall/ACL

https://www.cisco.com/c/en/us/products/collateral/routers/wan-automation-engine/white_paper_c11-728551.html
The simplest core capacity planning processes use passive measurements of core link utilization statistics and apply rules of thumb, such as upgrading links when they reach 50 percent average utilization, or some other general utilization target.

https://www.cisco.com/c/dam/en_us/about/ciscoitatwork/downloads/ciscoitatwork/pdf/Cisco_IT_Case_Study_Capacity_Planning.pdf
A WAN circuit running at 80 percent of capacity is too full. Even a circuit that averages 60 percent of capacity may well peak at 95 percent of capacity for several periods during a day, reducing user productivity and negatively affecting business activities. Many IT organizations order new circuits (which can take anywhere from 30 to 90 days to deploy) when a circuit operates at 60 to 80 percent of capacity.

• (Monitoring) Разная нагрузка по памяти и CPU может являться нормой, поэтому лучше всего понять, какая нагрузка нормальна и отклонения от нее рассматривать. Я считаю это логичный, но спорный подход – напр. один тип оборудования в разных сегментах может иметь разные нормы, делать специфику для каждого при больших объемах устройств сложно и глупо – в том числе возможны ошибки (забыли убрать/поставить на специфичный мониторинг и проч), да и стоит ли формировать вообще аларм мониторинга, если оборудование не достигает известных граничных показателей и потребление CPU/памяти планомерно не растет.

https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2018/pdf/BRKARC-3146.pdf
CPU
At what percentage level should I start troubleshooting ? It depends on the nature and level of the traffic. It is very essential to find a baseline CPU usage during normal working conditions, and start troubleshooting when it goes above a specific threshold. E.g., Baseline CPU usage 25%. Start troubleshooting when the CPU usage is consistently at 50% or above.

Memory
At what percentage level should I start troubleshooting ? It depends on the nature and level of feature config on the switch. It is very essential to find a baseline memory usage during normal working conditions, and start troubleshooting when it goes above specific threshold. E.g., Baseline memory usage 40%. Start troubleshooting when the memory goes above 70% and constantly keeps increasing without adding any new configuration.

• Множество примеров распространнености (Cisco, Juniper, Huawei, Solarwinds, Hitachi, IBM) использования 80% порога как верхней границы при capacity planning и как нижней границы мониторинга (Informational/Alert) как при мониторинге каналов, так и устройств (память ОП/HDD, CPU)

https://stackoverflow.com/questions/2302054/optimal-cpu-utilization-thresholds
Yep, I'd suggest 100% is thrashing so wouldn't want to see processes running like that all the time.
I've always aimed for 80% to get a balance between utilization and room for spikes / ad-hoc processes.

htps://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_10_5_1/Configuration/Guide/UCCE_BK_S8839AA8_00_serviceability-best-practices-guide/UCCE_BK_S8839AA8_00_serviceability-best-practices-guide_chapter_01000.html
Threshold: 80% (of physical memory)

https://www.juniper.net/assets/uk/en/local/pdf/solutionbriefs/3510631-en.pdf
If the data for a given KPI exceeds the thresholds specified
by the network operator—in this example, 50% and 80%
utilization—HealthBot will trigger an alert. Depending on which
threshold is exceeded, the alert will either be yellow or red in
the dashboard. These triggers can also drive alerts through
other notification channels, like e-mail, as well as other systems.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/92x/icam/b-cisco-nexus-9000-series-nx-os-icam-configuration-guide-92x/b-cisco-nexus-9000-series-nx-os-icam-configuration-guide-92x_chapter_010.html
Info Threshold = 80 percent (default) |
Warning Threshold = 90 percent (default) |
Critical Threshold = 100 percent (default)

https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/rising-threshold-edit-snmp-health-monitor-qfx-series.html
rising-threshold (Health Monitor)
Default: 80 percent of the maximum possible value

https://support.huawei.com/enterprise/en/doc/EDOC1000178172/6c42dd2e/configuring-the-log-and-alarm-threshold-for-inbound-and-outbound-bandwidth-usage
The default log threshold for inbound and outbound bandwidth usage on an interface is 80%.
At 5T, the interface bandwidth usage reaches 75%. The system generates a log to ask you whether to expand the device capacity.
If you do not expand the device capacity, the interface bandwidth usage reaches 80% at 6T. The system generates an alarm, indicating that the bandwidth is almost exhausted and reminding you to take proper operations.

https://support.huawei.com/enterprise/ru/doc/EDOC1100058923/bfc52bc9/configuring-the-thresholds-of-cpu-usage-and-memory-usage
By default, the overload threshold value of CPU usage is 95, and the alarm recovery threshold of CPU usage is 75.
By default, the overload threshold value of memory usage is 95, and the alarm recovery threshold of memory usage is 75.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/bsm/configuration/15-2mt/bsm-cpu-thresh-notif.html
The following example shows how to set a rising CPU thresholding notification for total CPU utilization. When total CPU utilization exceeds 80 percent for a period of 5 seconds or longer, a rising threshold notification is sent.
Router(config)# process cpu threshold type total rising 80 interval 5
Setting a Falling CPU Thresholding Notification Example
The following example shows how to set a falling CPU thresholding notification for total CPU utilization. When total CPU utilization, which at one point had risen above 80 percent and triggered a rising threshold notification, falls below 70 percent for a period of 5 seconds or longer, a falling threshold notification is sent.

https://documentation.solarwinds.com/en/success_center/nta/content/nta-finding-the-cause-of-high-bandwidth-utilization-sw1419.htm
For example, you may have set the trigger threshold at 80% of interface bandwidth and you now see an alert-related event.

IBM System Storage SAN Volume Controller and Storwize V7000
Procure more bandwidth if the utilization rises above approximately 80 percent of your configured bandwidth guarantees at any time.

https://knowledge.hitachivantara.com/Documents/Storage/NAS_Platform/13.6/NAS_Administration_Guides/File_Services_Administration_Guide/20_Controlling_file_system_space_usage
The file system should be maintained at a usage level no higher than 80%.

https://www.datacenterknowledge.com/archives/2013/03/06/improving-capacity-planning-using-application-performance-management
First, when a problem does occur, APM will alert IT operations of the incident. For example, let’s say a server has exceeded 80 percent utilization.
In this scenario, IT knows it needs to take action and can dig down into the server workload data.
Capacity management can then be used to run what-if scenarios for the affected server and entire application delivery chain, providing a plan that addresses the machine causing the alert in APM. The fix could be something as simple as upgrading the underlying hypervisor to a new version, which will change the workload characteristics and bring the server’s performance back into line.

https://visualstorageintelligence.com/balancing-performance-and-capacity-in-your-future-storage-plans/
In a typical capacity plan, an organization might set their percent of available capacity threshold to 80 percent.