About heuristic detection systems it is wrong to say:

The problem with approaches like this is the potential for alerts that aren't really intrusions

They can be challenging because it may require a lot of tuning to keep the baseline up to date.

From the standpoint of a forensic investigator, they can be useful because they may provide a lot of data about anything that occurs that isn't normal, which may be a lot of information.

Unlike signature$-$based systems, there is total control over what gets detected