Anomaly detection job severity score change

[richcollier]

Yes, the score can go down if a more serious anomaly happens later.

Anomaly Score < 1, despite a big difference between actual and typical detections

Scoring is relative to other anomalies. The yellow one right after seems more egregious (less probable and thus higher scoring) than the ones circled. Additionally, there is a difference between what an anomaly is scored when the anomaly happened (in real-time) versus what it might be scored as later (after a more egregious anomaly is seen). You can tell by looking at the "initial score" of an anomaly: [image] More info on scoring: Machine Learning Anomaly Scoring and Elasticsearch - How it W…