Anomaly Agent

Detects sudden changes in event volume (spikes + drops) and surfaces an insight for the workspace. Catches integration outages and viral moments early.

How it detects

Runs on every workspace once a day. For each metric below, compares the last 24-hour count against the prior 7-day daily average (excluding the current 24h window):

  • new_profiles_24h — new profiles created
  • events_24h — events ingested

A metric only signals when (a) the baseline has at least minBaselineDaily data points (default 7) and (b) the absolute deviation against baseline meets signalThreshold (default 0.5, meaning ±50%). Insights are filed at opportunity severity by default, or warning when the deviation drops below -warningDeviation (default -0.3).

Per-workspace tunables

Defaults are conservative — quiet on new workspaces, noisy enough on real volume. To tune, visit /dashboard/settings/workspace → Agent thresholds:

  • anomaly.minBaselineDaily — minimum baseline events/profiles per day before a metric is eligible to signal. Higher = fewer false positives on small workspaces.
  • anomaly.signalThreshold — |Δ| / baseline that flips a metric into signal territory. 0.5 = ±50%.
  • anomaly.warningDeviation — a negative deviation steeper than this elevates severity from opportunity → warning.

All three settings are validated server-side with Zod; out-of-range values are rejected at save time.

Integration with Slack

Anomalies are fanned out to the workspace's Slack integration (when configured) via the insight pipeline — same severity ladder as Slack pings from any other agent.