Anomaly detection

Rules catch what you thought to ask for. Anomaly detection catches the rest: a value that has moved far enough from its own history to be worth a look, on a series nobody has written a rule about yet.

It runs alongside the rule set rather than replacing it. Rules remain the precise instrument — thresholds and changes you understand exactly — while anomaly scoring watches for the behaviour your rule set does not cover.

Each series is compared against itself. The platform keeps a rolling view of the recent past for every series it monitors, so a current value is measured against how that series has actually behaved, not against a number somebody typed in months ago.

• A rolling window of recent history per series — thirty days of readings in the standard configuration.
• A short window compared against the long one: the last week against the thirty-day baseline.
• Separate baselines per location, category or source, so a quiet area is judged by its own normal.
• Works on anything already ingested as a time series — counts, readings, prices, incidents.

A deviation receives a score rather than a verdict: how far the current value sits from its baseline, and how long it has stayed there. Scores are ranked, so a three-day climb in a low-volume series can outrank a single busy hour somewhere else.

• Distance from the baseline, in the units the series is already understood in.
• Persistence, so a sustained shift is treated differently from one stray reading.
• Severity levels that decide what escalates to a person and what simply stays visible.

Every monitored series also carries its recent movement. Week-over-week and month-over-month change are available beside a sparkline of the last month of readings, so the current value is read in context instead of in isolation.

Where a series is moving, a short-horizon projection extends it three to seven days ahead with a confidence interval around the projection. That is what converts a spike into lead time — the moment when a decision can still be made cheaply.

The point of an anomaly score is lead time: the earlier a deviation is seen, the cheaper the response.

Scores and rules answer different questions, and using both is what makes a monitoring setup mature. A rule states what you already know you care about; a score reports that something changed in a series nobody was watching closely.

The loop between them is short. A score draws attention to a deviation, somebody decides whether it matters, and if it keeps mattering they write a rule with the threshold the evidence now supports.

Anomaly scores pay off where the interesting events are rare and the volume is low. A district recording three incidents a month is invisible to a threshold set for the province; measured against its own history, those same three incidents are a movement.

They also provide lead time where a rule can only report. A series that has been climbing for a week is caught by its score days before it crosses any threshold you would reasonably have chosen.

• Rises in low-volume series that thresholds ignore.
• Gradual shifts with no single dramatic day.
• Evidence for where a threshold should sit, before it becomes a rule.

A score is a question, not a verdict, and it is worth being explicit about that. It does not decide what matters to your operation, and it cannot score a series that nobody collects in the first place.

It also does not replace the people who know what normal looks like where they work. The score narrows the field; domain knowledge is still what turns a deviation into a decision.

• It does not decide what is important — it ranks what has moved.
• It cannot score a series that is not collected.
• It does not replace local knowledge of what is normal.

Start by pointing it at the series you already trust: the measures your team tracks routinely. A week of scoring against real history is usually enough to see whether the baselines fit the operation, and where a rule would be simpler than a score.

From there the useful conversation is about the deviations it found, not the model behind them. Each one is either a real movement worth a response or a reason to adjust the window — and both outcomes leave you with a better baseline.