What this page shows
Every anomaly event the service has fired across the
fleet, newest first. One row = one event on one (asset, parameter)
pair.
How an event is created
Every minute the service compares each new reading to what the model
predicted. If the value is far enough from the prediction, the
reading is tagged anomalous. When the system sees several
anomalous minutes in a row (a "streak"), it opens an event so a
human can look at it. After 5 minutes of quiet the event auto-closes.
The three statuses
- open — currently firing. The signal hasn't returned to normal yet.
- acked — open, but a human has clicked acknowledge. Still firing, just not unread.
- cleared — over. The signal returned to normal and stayed there for at least 5 minutes.
Columns explained
- Started / Ended — first and last anomalous minute of the streak.
- Peak score — how far outside the predicted band the reading went, at its worst. Bigger number = more unusual. Anything above 3 is well past the safe band.
- Top contributors — the other parameters on the same asset that were also misbehaving around the same time. Useful for figuring out the root cause.
How to use this page
Use the filters to focus on what matters — e.g. only
open events on one zone. Click a row to
open the event detail page, which shows the trace at the time, the top
contributors and similar past events.