# Anomaly detection job severity score change

**URL:** <https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [April 13, 2022, 6:17am UTC](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290 "2022-04-13T06:17:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerojin63](https://avatars.discourse-cdn.com/v4/letter/z/97f17d/32.png) [@zerojin63](https://discuss.elastic.co/u/zerojin63)\
**Post date:** [April 13, 2022, 6:17am UTC](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290/1 "2022-04-13T06:17:17Z")

</div>

Hi

I've been running an ML job to detect high amount of data stream.

Here's specific configuration of the job.

```auto
Detectors: high_count partition_field_name=src_ip
bucket_span: 1d

```

So the thing is that **the 'severity' of anomalies sometimes change after being detected by the job**.

For example, today at 11AM an alert showed up notifying that an anomalous activity was detected with severity of 91, influenced by src\_ip: 10.10.10.10.  
But when I checked it again at 3PM the severity went down to 32.

I thought severity score could go up as time goes by & log stacks up (since the job detects anomaly based on log count).

**But is it possible for the severity score to go down as well?**

I'd appreciate any opinion/answer.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [April 13, 2022, 10:55am UTC](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290/2 "2022-04-13T10:55:08Z")

</div>

Yes, the score can go down if a more serious anomaly happens later.

> [@Anomaly Score \< 1, despite a big difference between actual and typical detections](https://discuss.elastic.co/t/anomaly-score-1-despite-a-big-difference-between-actual-and-typical-detections/299743/2):
>
> Scoring is relative to other anomalies. The yellow one right after seems more egregious (less probable and thus higher scoring) than the ones circled. Additionally, there is a difference between what an anomaly is scored when the anomaly happened (in real-time) versus what it might be scored as later (after a more egregious anomaly is seen). You can tell by looking at the "initial score" of an anomaly: More info on scoring: [Machine Learning Anomaly Scoring and Elasticsearch - How it W…](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2022, 10:55am UTC](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290/3 "2022-05-11T10:55:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.