Anomalies Page

The data that populates the Logs - Anomalies page is based on the configurations of your monitors. Monitors, specifically the pattern-check and pattern-skyline monitors, analyze a pattern’s behavior. If an anomaly is detected in the pattern, then the monitor will create a finding.

There are default monitors already configured when you install an agent.

Data Types

The Anomalies page displays the following data types:

Anomalies Overview

By default, this graphic displays anomalies for all tags and corresponding source types in your account. You can hover over the graphic to view detailed information about the anomaly.

Anomalies By Tag

By default, this graphic displays a maximum of 12 anomalies for any tag in your account. The anomaly score determines the color of the specific hexagon.

• For green and yellow-colored hexagons, you can hover over to view detailed information about the anomaly.
• A red-colored hexagon indicates that the anomaly contains an EDAC, regardless of the anomaly score. You can click on the red hexagon to view details on a separate page.

Anomalies By Agent

By default, this graphic displays a maximum of 12 anomalies for any agent instance (host) in your account, regardless of the corresponding tag. The anomaly score determines the color of the specific hexagon.

• For green and yellow-colored hexagons, you can hover over to view detailed information.
• A red-colored hexagon indicates that the anomaly contains an EDAC, regardless of the anomaly score. You can click on the red hexagon to view details on a separate page.

Top Anomalies

By default, this graphic displays the top anomalies for any tag in your account. A top anomaly is based on its anomaly score. This graphic displays a maximum of 12 anomalies. This graphic may display anomalies that are also displayed in the Anomalies By Tag and Anomalies By Agent graphics.

Top Anomaly Score History

This graphic displays specific anomalies and their corresponding anomaly scores. You can hover over the lines to view detailed information about the anomaly. On the right side of the graphic, you can click on the legend to display (or not display) specific data types.

Regardless of your filter settings, this graphic will display the same time intervals.

Filter Displayed Data

When you access the Anomalies page, by default, data is displayed for the previous 15 minutes.

You can change the timeframe of the displayed data:

1. Click Lookback.
2. Choose a timeframe:

• To update the timeframe with a generic timeframe, such as 1 hour or 2 days, click Relative, and then select a generic time frame.
• To update the timeframe with a specific timeframe, such as December 14, 2021, at 1:00PM to December 16, 2021 at 12:30PM, click Custom, and then make your configurations.

You can also filter by tag, specific source type, source and host in the Filters section.