Every metric on every host gets a learned baseline. Deviations are scored, classified by severity, and shown on the chart where they happened — so you see the drift before the threshold catches up.
We don't train a different model on every host. The maths is straightforward, the windows are sensible, and the score is on the chart you're already looking at.
Per metric, per host. Mean + stdev over a 7-day window, recomputed continuously. No bake-in, no static thresholds to maintain.
How many standard deviations from the mean? That's the z-score. Big z = unusual; sustained big z = anomaly.
Severity assigned by z-score band and duration. Anomalies surface inline on the chart and feed the alert system as a separate source.
The bands are explicit so the noise floor stays in your control — no “the model decided” surprises.
Drift, but inside expected range. Charted, not alerted.
Notable deviation. Surfaces in dashboards and the timeline; can opt-in for alerts.
Sustained deviation. Default alert source on. Routed via your channels.
Far-tail event. Auto-incident, AI Triage suggested, evidence pre-attached.
On every metric. On every host. Without tuning.