[Index]
Persisted anomaly record detected by the anomaly detection system. Each record represents a single detected anomaly with detection_method discriminator, type, severity, deviation_score, significance evidence, occurrence_count for duplicate tracking, and reference to the source config and affected resource.
Model ref.: data/DetectedAnomaly
The full URL would include the host-proxy name: https://[host-proxy].
Variables are enclosed in square brackets.
{
"$schema": "http://json-schema.org/draft-03/schema",
"type": "object",
"properties": {
"anomaly_type": {
"title": "Anomaly Type",
"description": "Classification of the detected anomaly",
"type": "string",
"required": true,
"choices": [
{
"value": "config_drift",
"title": "Config Drift"
},
{
"value": "threshold_breach",
"title": "Threshold Breach"
},
{
"value": "pattern_deviation",
"title": "Pattern Deviation"
}
],
"maxLength": 1024
},
"detection_method": {
"title": "Detection Method",
"description": "Discriminator indicating how the anomaly was detected",
"type": "string",
"required": true,
"choices": [
{
"value": "isolation_forest",
"title": "Isolation Forest"
},
{
"value": "config_drift_analysis",
"title": "Config Drift Analysis"
},
{
"value": "prophet_forecast",
"title": "Prophet Forecast"
}
],
"maxLength": 1024
},
"severity": {
"title": "Severity",
"description": "Severity level of the detected anomaly",
"type": "string",
"required": true,
"choices": [
{
"value": "low",
"title": "Low"
},
{
"value": "medium",
"title": "Medium"
},
{
"value": "high",
"title": "High"
},
{
"value": "critical",
"title": "Critical"
}
],
"maxLength": 1024
},
"confidence": {
"title": "Confidence",
"description": "Confidence level of the anomaly detection (very_high >= 0.85, high >= 0.70, medium >= 0.50, low < 0.50)",
"type": "string",
"required": true,
"choices": [
{
"value": "low",
"title": "Low"
},
{
"value": "medium",
"title": "Medium"
},
{
"value": "high",
"title": "High"
},
{
"value": "very_high",
"title": "Very High"
}
],
"maxLength": 1024
},
"affected_resource": {
"title": "Affected Resource",
"description": "Identifier of the affected resource (resource path or name from any datasource)",
"type": "string",
"required": true,
"maxLength": 1024
},
"title": {
"title": "Title",
"description": "Human-readable anomaly title",
"type": "string",
"required": true,
"maxLength": 1024
},
"description": {
"title": "Description",
"description": "Detailed description of the anomaly",
"type": "string",
"required": true,
"maxLength": 1024
},
"first_detected_at": {
"title": "First Detected At",
"description": "Timestamp when the anomaly was first detected",
"type": "string",
"format": "date-time",
"required": true,
"maxLength": 1024
},
"expires_at": {
"title": "Expires At",
"description": "Timestamp when the anomaly record expires",
"type": "string",
"format": "date-time",
"required": true,
"maxLength": 1024
},
"detection_config": {
"title": "Detection Config",
"description": "Reference to the AnomalyDetectionConfig that triggered this detection",
"type": "string",
"format": "uri",
"required": true,
"target": "/api/data/AnomalyDetectionConfig/choices/?field=name&format=json&hierarchy=[hierarchy]&auth_token=[authtoken],
"target_attr": "name",
"maxLength": 1024,
"target_model_type": "data/AnomalyDetectionConfig",
"choices": []
},
"detection_run": {
"title": "Detection Run",
"description": "Reference to the AnomalyDetectionRun that produced this anomaly. Used for cascading cleanup when run records expire.",
"type": "string",
"format": "uri",
"required": false,
"target": "/api/data/AnomalyDetectionRun/choices/?field=run_id&format=json&hierarchy=[hierarchy]&auth_token=[authtoken],
"target_attr": "run_id",
"maxLength": 1024,
"target_model_type": "data/AnomalyDetectionRun",
"choices": []
},
"deviation_score": {
"title": "Deviation Score",
"description": "Normalized anomaly magnitude (0.0-1.0) stored as string. Absent means not computed.",
"type": "string",
"required": false,
"maxLength": 1024
},
"significance": {
"title": "Significance",
"description": "JSON-serialized structured evidence of why the anomaly was detected. Format varies by detection_method.",
"type": "string",
"maxLength": 8192,
"required": false
},
"occurrence_count": {
"title": "Occurrence Count",
"description": "Number of times this anomaly has been detected (incremented on duplicate detection)",
"type": "integer",
"required": false,
"default": 1
},
"last_detected": {
"title": "Last Detected",
"description": "Timestamp of the most recent detection of this anomaly",
"type": "string",
"format": "date-time",
"required": false,
"maxLength": 1024
},
"idempotency_key": {
"title": "Idempotency Key",
"description": "Deterministic hash for duplicate suppression. Computed from detection_config + affected_resource + anomaly_type + baseline_fingerprint + detection_method",
"type": "string",
"required": false,
"maxLength": 1024
},
"raw_data": {
"title": "Raw Data",
"description": "JSON-serialized diagnostic data from the detection run. Deserialized by the application layer.",
"type": "string",
"maxLength": 524288,
"required": false
}
},
"schema_version": "0.6.0"
}
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get the GUI Add form. | GET | /api/data/DetectedAnomaly/add/ |
|
The GUI Add form of data/DetectedAnomaly as JSON |
The API call to the /add/ URL can only be made from a hierarchy that allows the model type to be added. The actions in the response shows the url for the POST API call to create an instance.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Create | POST | /api/data/DetectedAnomaly | hierarchy=[hierarchy] |
|
tool/Transaction/[trans pkid]to inspect the created resource and its instance pkid.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Bulk delete [pkid1],[pkid2]... | DELETE | /api/data/DetectedAnomaly/ | hierarchy=[hierarchy] | {"hrefs":["/api/data/DetectedAnomaly/[pkid1]", "/api/data/DetectedAnomaly/[pkid2]", ...]} |
GET http://[host-proxy]/api/data/DetectedAnomaly/?hierarchy=[hierarchy]&format=json
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Get a selected [export_format] of the schema and instances [pkid1], [pkid2],... of data/DetectedAnomaly; optionally with tag_version at [version] and Configuration Template as [configtemplate]. | POST | /api/data/DetectedAnomaly/export/ |
|
{ "hrefs":["/api/data/DetectedAnomaly/[pkid1]", "/api/data/DetectedAnomaly/[pkid2]",...]}} |
For export_format=json, the response is a time stamped zip file of data in JSON as in the system database. Item properties such as strings that are empty or Boolean values that are not set, are not included. The filename in the response is of the format as the example:
Content-Disposition: attachment; filename=export_2013-05-17_14:20:19.186444.json.zip
Content-Language:en
Content-Type:application/x-zip
For export_format=raw_xlsx, the response is a MS Excel spreadsheet with columns corresponding to the JSON format export and a response filename format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=xlsx, the response is a MS Excel spreadsheet, arranged by any Field Display Policies that apply. The columns correspond with those of a Bulk Load Template export sheet. The response filename format is:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_formatted_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
The XLSX format can be used to bulk load instances of data/DetectedAnomaly and the JSON format can be used to import instances of data/DetectedAnomaly.
GET http://[host-proxy]/api/data/DetectedAnomaly/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Configuration Template | GET | /api/data/DetectedAnomaly/configuration_template/ | hierarchy=[hierarchy] |
|
POST http://[host-proxy]/api/data/ConfigurationTemplate/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Field Display Policy | GET | /api/data/DetectedAnomaly/field_display_policy/ | hierarchy=[hierarchy] |
|
POST http://[host-proxy]/api/data/FieldDisplayPolicy/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Migration Template | GET | /api/data/DetectedAnomaly/migration/ |
|
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| List | GET | /api/data/DetectedAnomaly/ |
|
The data/DetectedAnomaly schema and all instances as JSON. |
(The list will return 0 to 3 data/DetectedAnomaly instances)
{
"pagination": {
"skip": 0,
"limit": 3,
"maximum_limit": 2000,
"total": 0,
"total_limit": null,
"order_by": "last_detected",
"direction": "asc",
"current": "/api/data/DetectedAnomaly/?skip=0&limit=3&order_by=last_detected&direction=asc&traversal=down"
},
"operations": [
"add",
"bulk_update_form",
"list",
"update",
"transform",
"migration",
"remove",
"export",
"help",
"configuration_template",
"field_display_policy",
"get",
"export_bulkload_template"
],
"meta": {
"model_type": "data/DetectedAnomaly",
"summary_attrs": [
{
"name": "last_detected",
"title": "Last Detected"
},
{
"name": "first_detected_at",
"title": "First Detected At"
},
{
"name": "title",
"title": "Title"
},
{
"name": "detection_config",
"title": "Detection Config"
},
{
"name": "severity",
"title": "Severity"
},
{
"name": "confidence",
"title": "Confidence"
},
{
"name": "occurrence_count",
"title": "Occurrence Count"
},
{
"name": "detection_method",
"title": "Detection Method"
},
{
"name": "anomaly_type",
"title": "Anomaly Type"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [],
"title": "",
"business_key": {},
"api_version": "21.2",
"cached": true,
"references": {
"children": [],
"parent": [
{
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101",
"pkid": "6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": []
},
"model_specific_actions": [
"add",
"get",
"list",
"update",
"remove",
"export",
"configuration_template",
"field_display_policy",
"migration"
],
"schema_version": "0.6.0",
"actions": [
{
"add": {
"method": "GET",
"class": "add",
"href": "/api/data/DetectedAnomaly/add/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Add"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/DetectedAnomaly/?hierarchy=[hierarchy]",
"support_async": true,
"title": "Delete"
}
},
{
"export": {
"method": "POST",
"class": "export",
"href": "/api/data/DetectedAnomaly/export/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/?auth_token=[authtoken],
"submit": "payload"
}
},
{
"configuration_template": {
"method": "GET",
"class": "config",
"href": "/api/data/DetectedAnomaly/configuration_template/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Configuration Template"
}
},
{
"field_display_policy": {
"method": "GET",
"class": "display_policy",
"href": "/api/data/DetectedAnomaly/field_display_policy/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Field Display Policy"
}
},
{
"migration": {
"method": "GET",
"class": "migration",
"href": "/api/data/DetectedAnomaly/migration/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Migration Template"
}
},
{
"list": {
"method": "GET",
"class": "list",
"href": "/api/data/DetectedAnomaly/?hierarchy=[hierarchy]",
"support_async": false,
"title": "List"
}
}
]
},
"resources": []
}
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Modify | PUT | /api/data/DetectedAnomaly/[pkid] | hierarchy=[hierarchy] | (For payload specification) |
For Bulk modification, refer to the Bulk Modify section.
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Delete | DELETE | /api/data/DetectedAnomaly/[pkid] | hierarchy=[hierarchy] |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get a selected [export_format] of the schema and a single instance with [pkid] of data/DetectedAnomaly; optionally with tag_version at [version] and Configuration Template as [configtemplate]. | GET | /api/data/DetectedAnomaly/[pkid]/export |
|
The response is an attachment. Refer to the list below. |
For export_format=raw_xlsx, the response is a "raw" MS Excel spreadsheet with columns corresponding to the JSON format export and a response format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=xlsx, the response is a MS Excel spreadsheet, formatted to show all columns and a response format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_formatted_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=json, the response is a time stamped zip file of data in JSON and a response format:
Content-Disposition: attachment; filename=export_2013-05-17_14:20:19.186444.json.zip
Content-Language:en
Content-Type:application/x-zip
The XLSX format can be used to bulk load instances of data/DetectedAnomaly and the JSON format can be used to import instances of data/DetectedAnomaly.
For Bulk Export, refer to the Bulk Export section.
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get | GET | /api/data/DetectedAnomaly/[pkid] | hierarchy=[hierarchy] | The data/DetectedAnomaly instance with [pkid]. |