# Anomaly detection alerts

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Fmetrics%2Fanomaly-detection-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Falerting%2Fcreate-an-alert%2Fmetrics%2Fanomaly-detection-alerts.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Anomaly detection alerts catch metric behavior that drifts from its normal pattern, without you setting a fixed threshold. Use them when a meaningful level changes over time, for example, when a transaction's response time climbs above what is typical for that hour or a host's outbound traffic exceeds its usual range.

Coralogix learns the expected behavior of each metric series from recent history and triggers when live values deviate from that baseline. These alerts evaluate streaming metrics in real time, without prior indexing.

## What you need[​](#what-you-need "Direct link to What you need")

* Access to Coralogix with permission to create alerts
* A metric with enough history to build a reliable baseline (see [Data requirements](#data-requirements))

## Build an anomaly alert[​](#build-an-anomaly-alert "Direct link to Build an anomaly alert")

To create an anomaly detection alert, go to **Alerts**, then select **Create alert**. The [alert creation wizard](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md) opens on the Query step. The Anomaly type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details); the parts below are specific to anomaly detection.

### Query: define the metric signal[​](#query-define-the-metric-signal "Direct link to Query: define the metric signal")

1. On the Query step, select the **Anomaly** alert type.
2. Define the metric series to model. Switch between **Builder** and **Query** to construct a PromQL expression, group by labels, and preview the result series.

The series your query defines, including its grouping, is what Coralogix learns a baseline for. Each combination of group-by label values is modeled separately.

### Condition: deviation from the baseline[​](#condition-deviation-from-the-baseline "Direct link to Condition: deviation from the baseline")

On the Condition step, set the direction of the deviation that should trigger the alert:

* **More than usual**: fire when the metric rises significantly above its learned baseline.
* **Less than usual**: fire when the metric drops significantly below its learned baseline.

Tune how far a value must deviate before the alert fires with the deviation percentage. See [Anomaly sensitivity](https://docs-docusaurus.kinsta.page/user-guides/alerting/anomaly-detection-deviation-percentage/.md) for how this setting maps to detection behavior. To absorb late-arriving metric data, add a [custom evaluation delay](https://docs-docusaurus.kinsta.page/user-guides/alerting/custom-evaluation-delay/.md).

For the Notification and Details steps, including routing, cadence, naming, and labels, see [Configuring an alert definition](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md).

## Data requirements[​](#data-requirements "Direct link to Data requirements")

Anomaly detection needs enough historical data to establish a reliable baseline.

* The model trains on the previous 7 days of metric data.
* At least 90% of this 7-day period must contain data.
* This requirement applies to the training window, not the alert evaluation window.

If this requirement is not met, no baseline is created and anomaly detection does not run.

### When the alert becomes active[​](#when-the-alert-becomes-active "Direct link to When the alert becomes active")

The 7-day requirement applies to the metric history, not the alert age. If the metric already has more than 7 days of history when you create the alert, the alert becomes active within approximately 24 hours, after the next daily model build. You do not need to wait 7 days from alert creation.

If the metric has less than 7 days of history at creation time, the alert becomes active once 7 days of history accumulate.

### Changes that trigger a new learning period[​](#changes-that-trigger-a-new-learning-period "Direct link to Changes that trigger a new learning period")

Some edits to an alert definition retrain the model, which restarts the 7-day learning period and temporarily disables the alert. Others do not affect the model.

Changes that trigger a new learning period:

* Creating a new anomaly detection alert
* Changing the metric query, filter, or PromQL expression
* Changing core condition logic that defines the time series being modeled

Changes that do not trigger a new learning period:

* Changing the deviation percentage or sensitivity
* Changing notification settings, labels, or suppression rules
* Changing the alert name or priority

Note

Plan metric query changes carefully. Editing the query retrains the model and leaves the alert inactive for the duration of the new learning period.

## Limitations[​](#limitations "Direct link to Limitations")

* The baseline is rebuilt daily and applied for the following 24 hours.
* The model uses data from the past 7 days.
* A maximum of 500 permutations per metric is supported.

## Related resources[​](#related-resources "Direct link to Related resources")

[Anomaly sensitivity](https://docs-docusaurus.kinsta.page/user-guides/alerting/anomaly-detection-deviation-percentage/.md)[Configuring an alert definition](https://docs-docusaurus.kinsta.page/user-guides/alerting/configuring-alert-definition/.md)[Notification Center](https://docs-docusaurus.kinsta.page/user-guides/notification-center/introduction/.md)

## Next steps[​](#next-steps "Direct link to Next steps")

Set up custom webhook notifications for your metric alerts in [Custom webhooks: metric alerts](https://docs-docusaurus.kinsta.page/user-guides/alerting/create-an-alert/metrics/custom-webhooks-metric-alerts/.md).