Anomaly detection job severity score change

[zerojin63]

Hi

I've been running an ML job to detect high amount of data stream.

Here's specific configuration of the job.

Detectors: high_count partition_field_name=src_ip
bucket_span: 1d

So the thing is that the 'severity' of anomalies sometimes change after being detected by the job.

For example, today at 11AM an alert showed up notifying that an anomalous activity was detected with severity of 91, influenced by src_ip: 10.10.10.10.
But when I checked it again at 3PM the severity went down to 32.

I thought severity score could go up as time goes by & log stacks up (since the job detects anomaly based on log count).

But is it possible for the severity score to go down as well?

I'd appreciate any opinion/answer.

Thanks in advance

[richcollier]

Yes, the score can go down if a more serious anomaly happens later.

Anomaly Score < 1, despite a big difference between actual and typical detections

Scoring is relative to other anomalies. The yellow one right after seems more egregious (less probable and thus higher scoring) than the ones circled. Additionally, there is a difference between what an anomaly is scored when the anomaly happened (in real-time) versus what it might be scored as later (after a more egregious anomaly is seen). You can tell by looking at the "initial score" of an anomaly: [image] More info on scoring: Machine Learning Anomaly Scoring and Elasticsearch - How it W…