AIMO Docs

Outlier detection ​

Monitors produce aggregate numbers over time: a count, a rate, a sum or a similar summary per time block. Outlier detection decides which readings deserve an alert. AIMO does it without a trained model and without thresholds you set by hand: each monitor's own history says what to expect, each block adds to or takes from a running amount of suspicion, and one account-wide budget says how much suspicion an alert needs.

One monitor over time: the value against its expected value and band, the suspicion it builds, and the one episode that crosses the alert level Two lanes over the same time blocks. The upper lane is the monitor's value as a solid line, its expected value as a dashed line rolled forward from the monitor's own history, and a band around it. The value leaves the band upward for five blocks and returns. The lower lane is suspicion: nothing while the value sits inside the band, then bars that build block by block through the excursion, cross the dashed alert level on the fourth block, and fall back once the value returns. The five blocks are shaded as one episode, which sends one alert. The alert level is set by the account's alert budget. MONITOR VALUE the value leaves the band for five blocks band expected value SUSPICION alert level, set by the alert budget one episode, one alert suspicion built up over the blocks and crossed the level once time blocks now value expected value episode
The upper lane is the monitor's value against the expected value rolled from its own history, with the band of ordinary variation around it. The lower lane is suspicion: nothing while the value sits in the band, building through the five blocks it stays out, crossing the alert level once. Those blocks are one episode, and the episode sends one alert.

The expected value ​

For every monitor and every time block, AIMO rolls an expected value forward from the readings before that block: the recent level, the block's place in the daily and weekly rhythm (a weekend, a holiday, an hour of the day), and the momentum of the last few blocks. Nothing is fitted in advance and nothing is stored as a model. The expected value at a block is a function of the raw values before it, so it is the same whenever it is computed and never goes stale. The chart draws it as the dashed line, with a band around it showing how wide the monitor's ordinary variation runs at that block; the band is a picture of the history, not a threshold.

A monitor whose output has a floor or a ceiling, such as a violation count that cannot fall below zero, is judged on the side it can move on. A monitor can also be set to watch one direction only, up or down, when only that side matters.

Suspicion, and the alert level ​

Each block's reading is compared with its expected value, in units of that monitor's usual variation. A reading inside the band adds nothing; the further outside, the more suspicion the block adds. Suspicion accumulates over consecutive blocks and drains when readings return to the band, so a level that stays out of band builds up even when no single reading is dramatic. A single block can carry enough on its own when the reading is far out; more often the alert comes from suspicion built over several blocks.

The alert level is one setting for the whole account: the alert budget, stated as one false alert from a healthy monitor every so many years. Settings → Alerts shows each step of the dial with what it would have sent this account over the last 90 days, alerts a day and the days with at least one. A change takes effect on each table's next detector run; nothing is retrained, and there are no per-monitor knobs to tend. How the level is derived from the budget stays inside the product.

Violations and stable baselines

A monitor that counts violations per block raises suspicion on changes in that count, not on the count being above zero. A stable rate of violations becomes the expected value; what surfaces is the block where it moves.

Episodes ​

Consecutive blocks over which suspicion stayed positive form one episode, and the episode sends one alert, graded against the monitor's severity by how far its peak block went. A nine-day incident is one episode, not nine alerts. Today lists the episodes open now; Episodes is the register of every one; each opens the monitor's chart on its span, with the violating-rows query for the count families. You close an episode with a verdict: a real problem, expected, or only handled. A verdict of expected keeps those readings as part of the history; a verdict of a real problem keeps them from widening what the monitor considers ordinary.

Held silent ​

Most of what the detector produces is the decision not to speak. Suspicion, in the sidebar, audits the alert budget with four figures: the monitors carrying suspicion, how many became episodes, how many are open, and how many stayed under the alert level. Today's held-silent list names the monitors where suspicion built but did not cross, each opening the monitor's chart, so you can see what the budget bought without being paged for it.

No training period ​

When a table starts monitoring, its whole history is priced in one pass, so episodes appear over past blocks as well as the latest. The rhythm and momentum parts of the expected value switch on as the history grows long enough to support them; until then the level alone carries it, with a wider band. A change to a monitor (its direction, a verdict on its blocks) re-prices the table's history in the same deterministic pass; a change to the alert budget only moves the level.

The detector runs on aggregates in AIMO after the agent has supplied the monitor values. Raw rows stay on your side. For what the agent computes first, see Operations.