Anomaly Detection

Statistical anomaly detection for check metric time series.

Detectors

Anomaly detection algorithms using stdlib only.

detect_zscore(values, current, threshold=3.0)

Detect anomalies using Z-Score method.

Uses mean and standard deviation. Simple but sensitive to outliers in the historical data.

detect_mad(values, current, threshold=3.0)

Detect anomalies using Median Absolute Deviation (MAD).

More robust to outliers than Z-Score. Default method. MAD = median(|xi - median(x)|) * 1.4826

detect_iqr(values, current, threshold=1.5)

Detect anomalies using Interquartile Range (IQR).

Uses Q1/Q3 with fence k * IQR. Good for skewed distributions.

detect_anomaly(values, current, method='mad', sensitivity='medium')

Dispatch anomaly detection to the appropriate method.

Parameters:

Name	Type	Description	Default
values	list[float]	Historical metric values (oldest to newest).	required
current	float	The current value to check.	required
method	str	Detection method ("zscore", "mad", "iqr").	'mad'
sensitivity	str	Sensitivity level ("low", "medium", "high").	'medium'

Returns:

Type	Description
AnomalyResult	AnomalyResult with detection details.

Models

Anomaly detection models.

AnomalyResult

Bases: BaseModel

Result of an anomaly detection check.

Checks

Anomaly detection checks: anomaly, row_count_change.

check_anomaly(connection, table, check_config)

Generic anomaly detection on any historical metric.

Queries the current metric value from the data source, then compares it against historical values from the result store.

Parameters:

Name	Type	Description	Default
metric	str	Metric to check: row_count, null_count, null_rate, distinct_count, mean, min, max.	required
method	str	Detection method (default "mad").	required
sensitivity	str	Sensitivity level (default "medium").	required
threshold	float	Direct threshold override (optional).	required
column	str	Column for column-level metrics.	required
_suite_name	str	Injected by engine.	required
_check_name	str	Injected by engine.	required
_history	list[float]	Injected historical values (optional).	required
_store_path	str	Store path for history lookup (optional).	required

check_row_count_change(connection, table, check_config)

Check that row count hasn't changed beyond acceptable thresholds.

Queries current COUNT(*) and compares against the last stored row_count_change metric (its own history, not dependent on a separate row_count check).

Parameters:

Name	Type	Description	Default
max_decrease	str	Maximum allowed decrease, e.g. "20%".	required
max_increase	str	Maximum allowed increase, e.g. "300%".	required
_suite_name	str	Injected by engine.	required
_store_path	str	Store path for history lookup (optional).	required