Anomaly profiles

Admin → Anomaly profiles holds the rules that decide whether a metric’s movement is worth flagging. Without a profile, a metric is checked against built-in defaults.

Creating a profile

• Name — unique.
• Window size — how many prior runs form the comparison baseline.
• Deviation threshold — how far outside the baseline counts as an anomaly.
• Sensitivity — how eagerly to flag.

The three are one decision, not three. A long window with a tight threshold almost never fires; a short window with a loose one fires constantly and gets ignored. Adjust the window first — it is what determines whether a movement is signal or noise.

Assigning one

Attach a profile to a metric to override the default. Leave a metric on the default to inherit.

Note

A new tenant has no profiles of its own. Metrics scheduled with no profile assigned fall back to a built-in default profile, so they are still checked — with generic thresholds. See what a new tenant starts with.

Only certified metrics

Only certified metrics should be watched. Anomaly detection on an uncertified metric is alerting on a draft calculation, and an alert on an unreliable number trains people to dismiss alerts.

What a flag includes

Anomaly detection reports a breakdown by dimension alongside the flag, which is the part that makes it usable — the slice that moved, not only that something moved. Technical causes and genuine ones are distinguished. See self-watching metrics.

Scheduling

Detection runs when the metric runs, on the metric’s cadence. If a metric is not scheduled, no profile applies to it — profiles do not run metrics themselves.