An alert on add_to_cart is set to three sigma because three sounds careful, and then it either pages every night or stays silent through a broken checkout. Both outcomes follow from the volume, and both can be calculated before the first alert is configured.
Pure counting noise gives a dispersion factor of 1. Real traffic carries a daily and weekly rhythm on top of that, so a flat baseline sees a spread of roughly 1.5 to 2.5 times the counting noise. A factor of 1 is only honest against a baseline that already models the rhythm.