Anomaly Detection

Anomaly detection is the automatic identification of points that deviate meaningfully from a metric's normal, expected behavior, without anyone looking manually.

Anomaly detection is a step beyond a fixed-threshold alert: instead of 'if it crosses some number', it first learns the metric's normal behavior — with its trend and seasonality — and then flags departures from that pattern as anomalies. That 'learning normal' is the key difference, because it does not count a weekend dip, which looks like a problem to a fixed threshold, as an anomaly. The main challenge is tuning sensitivity: an over-sensitive model calls every swing an anomaly (false positives and alert fatigue), an under-sensitive one sees a real problem late. The important point is that an anomaly only says 'something unusual is here', not why; it is not an answer but the start of an investigation. An anomaly can be an instrumentation bug, a real event, or even an unexpected success.