Anomaly Rule DSL

You define anomaly detection rules in YAML by using a structured DSL schema that specifies detection templates like spike, drift, absence, and threshold, along with signal composition and execution scheduling parameters.

Anomaly alerting rules support configuring notifications through webhooks, email, and Telegram channels, allowing you to deliver critical alerts to the appropriate communication platforms when unusual patterns are detected.

Signal composition in anomaly detection allows you to combine multiple input signals within the YAML DSL schema, enabling complex rule logic that evaluates aggregated data patterns before triggering threshold or spike alerts.

Yes, the anomaly rule DSL schema supports OpenSearch enrichment, allowing you to augment detection rules with external data context to improve the accuracy of spike, drift, and absence pattern identification.

The available anomaly detection templates include spike detection for sudden increases, drift detection for gradual changes, absence detection for missing data, and threshold detection for boundary violations.

To detect login failure spikes, use the YAML DSL to configure a spike detection template targeting the login count feature, set notification parameters for critical thresholds, and schedule the rule execution frequency.