In production

Anomaly detection

Anomaly detection flags values that do not match what the series usually does at that clock. On seasonal business metrics, a forecast band beats a static threshold that treats every Tuesday like every Saturday.

A threshold of 'alert above 1,200' is a freeze-frame of last winter. Growth and season will either spam you or hide the incident. The forecast is a moving definition of normal.

Not every miss is an incident. Calibration, persistence (two ticks in a row), and a minimum volume keep pages from becoming wallpaper.

Sometimes the anomaly is the data, not the world: a feed of zeros, a delayed POS file. The first runbook step is 'is the pipe alive?'