What do "actual" and "typical" columns mean in the Anomaly explorer?

Hi

I am analyzing data with the Elastic X-Pack.
What does the "actual" and "typical" columns mean?
Is it the severity? the count of emails?

I do not understand.

Thank you

actual is the value that was observed for that detector in that particular bucket.

typical is the value that the model is expecting given past behavior.