...
Choose the anomaly detection algorithm from the available list of algorithms and define the duration for which the anomalous condition holds before an alert fires.
Basic
Use when metrics have no repeating seasonal pattern. Basic uses a simple lagging rolling quantile computation to determine the range of expected values. It uses little data and adjusts quickly to changing conditions but has no knowledge of seasonal behavior or longer trends.
Parameters
Window: rollup time duration to use.
Bound: Deviation bound to use for acceptable value. Input values outside of the acceptable bounds are considered anomalous. A value of 1 for bound means that the anomalous values are greater (or lesser) than 1 standard deviation from the input values.
Band:
upper: Use if only values higher than the upper bound are to considered anomalous.
lower: Use if only values lower than the lower bound are considered anomalous.
both: Use if values higher than upper bound and lower than lower bound are considered anomalous.
Agile
Use when metrics are seasonal and expected to shift. The algorithm quickly adjusts to metric level shifts. A robust version of the SARIMA algorithm, it incorporates the immediate past into its predictions, allowing quick updates for level shifts at the expense of being less robust to recent, long-lasting anomalies.
Parameters
Window: rollup time duration to use.
Bound: Deviation bound to use for acceptable value. Input values outside of the acceptable bounds are considered anomalous. A value of 1 for bound means that the anomalous values are greater (or lesser) than 1 standard deviation from the input values.
Band:
upper: Use if only values higher than the upper bound are to considered anomalous.
lower: Use if only values lower than the lower bound are considered anomalous.
both: Use if values higher than upper bound and lower than lower bound are considered anomalous.
Robust
Use when seasonal metrics expected to be stable, and slow, level shifts are considered anomalies. A seasonal-trend decomposition algorithm, it is stable and predictions remain constant even through long-lasting anomalies at the expense of taking longer to respond to intended level shifts (for example, if the level of a metric shifts due to a code change.)
Parameters
Window: rollup time duration to use.
Bound: Deviation bound to use for acceptable value. Input values outside of the acceptable bounds are considered anomalous. A value of 1 for bound means that the anomalous values are greater (or lesser) than 1 standard deviation from the input values.
Model: Use additive model when the seasonal component does not vary with the level of the time series. Use multiplicative model if the seasonal component is proportional to the level of the time series.
Period: It’s value should be less than or equal to the Window selected in minutes.
Band:
upper: Use if only values higher than the upper bound are to considered anomalous.
lower: Use if only values lower than the lower bound are considered anomalous.
both: Use if values higher than upper bound and lower than lower bound are considered anomalous.
RRCF (Robust Random Cut Forest)
Use when static thresholds are not viable. RRCF algorithm is stable to both seasonality and trend as long as the parameters used are such that the input data captures the seasonality and the trend.
Parameters
Global history: Time window to use for the rolling dataset (from the metric query done over this time window). At any point in time, RRCF algo captures the signal behavior seen over this time window (essentially to capture trend).
Local history: Time window to use for capturing the signal behavior in recent past (essentially to capture seasonality).
Time window to use for capturing the signal behavior in recent past.Time window to use for capturing the signal behavior in recent past.Time window to use for capturing the signal behavior in recent past.
...