Interval Detection V2¶

V2 version of interval detection utilizes historical data to construct confidence intervals, predicting normal fluctuation ranges. The system compares current data characteristics with historical data to determine if they exceed the confidence interval, thereby identifying anomalies and triggering alerts to ensure data stability and security.

Main features:

• In-depth analysis: Predicts normal fluctuations based on historical data to build confidence intervals.
• Continuous updates: Continuously updated by the Guance algorithm team to enhance data processing capabilities.

Concepts¶

Confidence interval range (confidence_interval): A metric that measures the tolerance for fluctuation of time-series data within a specific detection range, with values between 1% and 100%. When data exhibits high volatility and randomness, this value can be appropriately increased; when data fluctuations are regular, it can be decreased. An overly large confidence interval widens the upper and lower boundaries, reducing the number of detected anomalies; an overly small confidence interval may detect too many anomalies; an overly large confidence interval may fail to detect any anomalies.

Therefore, adjusting this parameter reasonably based on the fluctuation characteristics of the data is crucial for balancing the sensitivity and accuracy of anomaly detection, effectively avoiding excessive false positives or missed anomalies.

Illustration:

Detection Configuration¶

Detection Frequency¶

Refers to the execution frequency of the detection rule, defaulting to 10 minutes and cannot be changed.

Detection Metrics¶

Refers to the monitored metric data.

Cross-Workspace Query Metrics¶

After authorization, detection metrics from other workspaces under the current account can be selected. Once the monitor rule is successfully created, cross-workspace alert configuration can be achieved.

Trigger Conditions¶

Configure trigger conditions for alert levels: You can configure any one of the trigger conditions for Emergency, Important, Warning, or Normal. Supports three forms of data comparison: upward (data increase), downward (data decrease), or upward or downward.

Configure trigger conditions and severity. When the query result contains multiple values, an event is generated if any value meets the trigger condition.

For more details, refer to Event Level Description.

Bulk Alert Protection¶

Enabled by default.

When the number of alerts generated in a single detection exceeds a preset threshold, the system automatically switches to a status summary strategy: Instead of processing each alert object individually, it generates a small number of summary alerts based on event status and pushes them.

This ensures timely notifications while significantly reducing alert noise and avoiding timeout risks caused by processing too many alerts.

Alert Level¶

1. Alert Level Emergency (red), Important (orange), Warning (yellow);

2. Alert Level Normal (green): Based on the configured number of detections, explained as follows:

   • Each execution of a detection task counts as 1 detection. For example, if Detection Frequency = 5 minutes, then 1 detection = 5 minutes.

   • The number of detections can be customized. For example, if Detection Frequency = 5 minutes, then 3 detections = 15 minutes.

   Level

   Description

   Normal

   After the detection rule takes effect, if an Emergency, Important, or Warning abnormal event occurs and the data detection result returns to normal within the configured custom number of detections, a recovery alert event is generated. ❗️ Recovery alert events are not subject to Alert Silence restrictions. If the number of detections for recovery alert events is not set, the alert event will not recover and will remain in the Events > Unrecovered Events List.

Data Gap¶

Seven strategies can be configured for data gap status.

1. Link with the detection interval time range to judge the query result of the most recent minutes of the detection metric, do not trigger an event.

2. Link with the detection interval time range to judge the query result of the most recent minutes of the detection metric, treat the query result as 0; at this time, the query result will be re-compared with the threshold configured in the Trigger Conditions above to determine whether to trigger an abnormal event.

3. Custom fill the detection interval value, trigger data gap event, trigger emergency event, trigger important event, trigger warning event, and trigger recovery event; when selecting this type of configuration strategy, the recommended custom data gap time configuration is >= detection interval time. If the configured time is <= the detection interval time, situations may arise where both data gap and abnormal conditions are met simultaneously. In such cases, only the data gap processing result will be applied.

Information Generation¶

Enable this option to generate "Information" events for detection results that do not match the above trigger conditions and write them.

Other Configurations¶

For more details, refer to Rule Configuration.