Skip to main content

Multi-event handling

The typical way of performing anomaly detection consists of comparing a single sample's anomaly score against a given threshold. While this process is intuitive, it also usually leads to many false positives: to address this challenge, Connhex AI aggregates anomalies based on post-processing rules.

Post-processing rules​

By default, the following post-processing is applied to any anomaly detection model available in Connhex AI.

AND evaluation

All conditions must be met for an anomaly to be detected.

  • Each data point's anomaly scored is compared against a configurable threshold. Only values over it move to the next stage
  • An alarm is only fired if there are at least n_min_anomalies in a window of window_size_min minutes. Both values are configurable
  • Once an alarm is raised, alarms won't be fired again for the next muted_window_size_min minutes, with a configurable value that defaults to 10.