{
  "version": {
    "slug": "anomaly-and-change-detection",
    "version": 1,
    "current_version": 1,
    "title": "Anomaly and change detection",
    "summary": "Find when a metric really changed, or design an alert that fires on real shifts and not on noise, with the false-alarm rate stated.",
    "category": "data",
    "tags": [
      "anomaly",
      "changepoint",
      "monitoring",
      "alerts",
      "time-series"
    ],
    "inputs_md": "- The data (file or link) and what each column means\n- Live watching or a look back over a finished record\n- What counts as a real change, and how many false alarms a week are acceptable\n- Known past incidents, so the detector can be checked against them\n- What happens when an alert fires",
    "steps_md": "1. **Pin the job.** Live or look-back need different methods. If the request doesn't say, ask.\n2. **Look before modelling.** Plot it; check gaps, duplicates, time zones, unit changes and outliers. Many \"changes\" are pipeline artefacts; say what was cleaned.\n3. **Always run baselines:** a rolling median with a spread threshold, and \"no change\". A method that can't beat them on known incidents isn't worth shipping.\n4. **Pick the detector.** Look-back with several changes: a penalised segmentation tuned by validation. Live with a probability of change: Bayesian online changepoint detection, robust to single outliers. One known shift size to catch fast: a sequential test tuned on delay versus false alarms.\n5. **Tune on evidence.** Use past incidents or injected synthetic changes as labels. Report precision, recall and detection delay.\n6. **Deliver runnable code** with fixed seeds and one command to run it.\n7. **For live alerts:** threshold, cooldown, a dedupe key so an unchanged condition doesn't alert twice, severity levels, and the evidence each alert carries.\n8. **Report misses plainly,** e.g. caught 3 of 4 known incidents with one possible false alarm.",
    "checks_md": "- Live vs look-back stated; context answered or assumptions listed\n- Compared against the baselines; false-alarm rate reported, not just hits\n- Code runs from a clean checkout with one command\n- Each change has a time, a size, a confidence and the series affected",
    "note": null,
    "created_at": "2026-11-07T00:15:23.365Z"
  }
}