> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Anomaly detection

> How Openlayer detects and explains unexpected changes in your tables

Openlayer’s anomaly detection helps you spot **unexpected changes in production data** with
minimal setup. It powers the [Anomaly detection test](/tests/catalog/anomalous-column-count) and flags
when metrics for a column deviate from their learned “normal” behavior.

## What it monitors

For each table you connect, Openlayer maintains time series for:

* **Numeric columns** — the **mean** daily value over time.
* **Categorical columns** — the **counts** of the daily **top categories** over time.

These series are learned per column and continuously updated as new data arrives.

## How detection works

Behind the scenes, what Openlayer is doing is:

<Steps>
  <Step title="Learn">
    We fit time-series models per monitored metric (numeric mean, categorical
    counts). The model captures trend/seasonality and estimates an **expected
    range** (upper & lower bounds) for each evaluation window.
  </Step>

  <Step title="Predict">
    For the current window, the model predicts the upper and lower bounds.
  </Step>

  <Step title="Compare">
    We compare the **observed value** with the predicted range. If the observed
    value is outside the predicted range, it is flagged as an anomaly.
  </Step>

  <Step title="Adapt">
    Models are **retrained regularly** so the expected range improves as your
    data evolves.
  </Step>
</Steps>

## Visualizing results

When an anomaly is detected, the result view shows:

* A **time-series chart** with the observed value and the **expected range band**.
  Green points fall within the band; orange points indicate anomalies.
* A **per-column selector** to inspect any monitored metric individually.

<img style={{ borderRadius: "0.5rem" }} width="700" src="https://mintcdn.com/openlayer-44/O1_M9YHCON_OMJql/images/documentation/time_series.png?fit=max&auto=format&n=O1_M9YHCON_OMJql&q=85&s=88a7761f20c5764e503c3546ec8b4317" alt="Time series" data-path="images/documentation/time_series.png" />

## Root-cause analysis (RCA)

For **categorical** anomalies, the Diagnostics tab includes **RCA**:

* Pick one or more categorical columns.
* See which **values were predominant** when the anomaly occurred.
* Use this to quickly form hypotheses (e.g., “spike only for `to_address = X`”),
  trace pipeline issues, or decide whether to suppress a benign seasonal effect.

  <img style={{ borderRadius: "0.5rem" }} width="700" src="https://mintcdn.com/openlayer-44/O1_M9YHCON_OMJql/images/documentation/rca.png?fit=max&auto=format&n=O1_M9YHCON_OMJql&q=85&s=17b548d410e5a20628d94ec78c4ac952" alt="Root-cause analysis" data-path="images/documentation/rca.png" />

## Configuration tips

* **Confidence interval (`interval_width`)**
  Smaller interval → **more sensitive** (more anomalies). Larger interval → less sensitive.
* **Timestamp column**
  Required so Openlayer can order data by time and form windows.
* **Cold start**
  New tables need some history to build a reliable baseline. Early bounds may be wider until the
  model learns seasonality.

## FAQ

<AccordionGroup>
  <Accordion title="What exactly is considered an anomaly?">
    A per-window value (numeric mean or categorical count) that falls
    **outside** the model’s predicted upper/lower bounds for that column.
  </Accordion>

  <Accordion title="Does it detect spikes and drops?">
    Yes—both excursions above the upper bound and below the lower bound are
    flagged.
  </Accordion>

  <Accordion title="Will it learn seasonality (weekends, end-of-month, etc.)?">
    Yes. As history grows, bounds adapt to recurring patterns, reducing false
    positives.
  </Accordion>

  <Accordion title="Can I be alerted?">
    Yes. Create an [Anomaly detection
    test](/tests/catalog/anomalous-column-count) and configure notifications on
    failures.
  </Accordion>
</AccordionGroup>