Auto-creation of Anomaly Detections

By default, auto-creation of Anomaly Detections is disabled for new installations or upgraded Discover solutions.

Through the Portal, you can enable auto-creation of Anomaly Detections using independent settings for daily and hourly Anomaly Detections.

  • Anomaly Detections are not auto-created for some event objects. See Limitations.

Enabling

When auto-creation is enabled for one or both types of Anomaly Detections, the following occurs:

  • Anomaly Detections for all active and reportable events and dimensions are immediately created, and tracking is enabled.
    Note: For systems with many events and dimensions, the number of Anomaly Detection that must be immediately created may be significant. The creation, subsequent calculations, and data storage requirements may significantly increase. See Data implications of auto-creating Anomaly Detections.
    Note: Newly created Anomaly Detections are not displayed in the Portal in draft mode or as new objects. They simply appear after creation. See Seeing updates in the Event Manager.
    • For events and event + dimension combinations that are provided by Discover, if the event object is marked as being reportable, then an Anomaly Detection is created for Discover event objects.
  • Anomaly Detections that were previously disabled remain disabled.
  • For any events and dimensions that are created after auto-creation was enabled, corresponding Anomaly Detections are also created, and tracking is enabled.
    • Data is not back-filled after an Anomaly Detection is auto-created.
    • When Anomaly Detections are next calculated, the new Anomaly Detection is included in the calculations. Data is calculated based on the data that is collected since the last Anomaly Detection calculation.

Disabling

Using the same Portal settings, you can disable auto-creation of Anomaly Detections. When auto-creation is disabled, the following occurs:

  • All currently active Anomaly Detections are disabled.
    • Anomaly Detections may be re-enabled manually through the Event Manager.
  • Anomaly Detections are not created automatically for later created events or dimensions.
Note: If an event is disabled, no corresponding Anomaly Detections are disabled. You must disable them manually.