Hello everybody,
i'am testing an anomaly job. At creation, it warned me that the cardinality is below 10 and it might not be suitable for population analysis.
I was asking myself, under which circumstances it might be unsuitable and when it can still produce useful results?
I assume that low cardinality is problematic especially when each entity exhibits very different characteristics thus rendering population analysis inadequate.
However, if we have a situation where we have low cardinality but high quantity of logs per entity and seemingly similar behaviour between those entities (implied by very few anomalies resulting from initial training/modeling) it appears to me as if population analysis is still applicable in this regard.
What's your opinion on this assumption?