mirror of
https://github.com/hanzoai/insights.git
synced 2026-11-02 14:32:45 +00:00
zeekay
1b367e2b62
The tree was a debranded snapshot of upstream taken around 2026-02-20, and upstream has moved about five months since. This replaces it with upstream master, mechanically re-derived: bin/debrand does the rename, and the pipeline and squashed migrations are restored from the shipped tree. Not a merge. The previous import replaced the tree wholesale in a single commit, so there is no shared content history to merge against. Reproducing the rename on the new tree is what actually converges. What survives: .hanzo/workflows, the Dockerfiles and bin/docker* entrypoints, compose files, LLM.md, and insights/migrations. The squashed initial migration is load-bearing — the live database records it by name, so upstream's ~918 individual migrations cannot come back. Nine products are dropped as unreferenced. Twenty-one more that we do not run are kept anyway because the core app still imports them; unpicking those is a refactor and does not belong in a rebase. This base does not build yet, and the reasons are not in the rename: upstream now wants Python 3.13.13 against our 3.12.12 and Django 5.2 against our 4.2, and the dependency manifests still name upstream packages that we republish under our own names. Those are decisions, not renames.
2383 lines
152 KiB
JSON
2383 lines
152 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"properties": {
|
|
"calculation_interval": {
|
|
"description": "How often the alert is checked: real time (Scale+), every 15 minutes (Boost+), hourly, daily, weekly, or monthly.\n\n* `real_time` - real_time\n* `every_15_minutes` - every_15_minutes\n* `hourly` - hourly\n* `daily` - daily\n* `weekly` - weekly\n* `monthly` - monthly",
|
|
"enum": ["real_time", "every_15_minutes", "hourly", "daily", "weekly", "monthly"],
|
|
"type": "string"
|
|
},
|
|
"condition": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"type": {
|
|
"enum": ["absolute_value", "relative_increase", "relative_decrease"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["type"],
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Alert condition type. Determines how the value is evaluated: absolute_value, relative_increase, or relative_decrease."
|
|
},
|
|
"config": {
|
|
"anyOf": [
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"check_ongoing_interval": {
|
|
"anyOf": [
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "When true, evaluate the current (still incomplete) time interval in addition to completed ones."
|
|
},
|
|
"series_index": {
|
|
"description": "Zero-based index of the series in the insight's query to monitor.",
|
|
"type": "number"
|
|
},
|
|
"type": {
|
|
"default": "TrendsAlertConfig",
|
|
"enum": ["TrendsAlertConfig"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["series_index"],
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"column": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Name of the result column to evaluate. When unset, the single numeric column is used (an error if the result has more than one numeric column)."
|
|
},
|
|
"evaluation": {
|
|
"description": "How to read the result rows — an explicit choice, no implicit default.",
|
|
"enum": ["last_row", "first_row", "any_row"],
|
|
"type": "string"
|
|
},
|
|
"label_column": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Column whose value labels the evaluated row(s) in breach messages: every row in `any_row` mode, or the single evaluated row in `last_row`/`first_row`. When unset, the first non-evaluated column is used, falling back to the row number (any_row) or the value column name (last_row/first_row)."
|
|
},
|
|
"type": {
|
|
"default": "InsightsQLAlertConfig",
|
|
"enum": ["InsightsQLAlertConfig"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["evaluation"],
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"check_ongoing_interval": {
|
|
"anyOf": [
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "When true, evaluate the current (still in-progress) period; by default only completed periods are used."
|
|
},
|
|
"funnel_step": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Zero-based step index to evaluate. Null = the last step (overall conversion)."
|
|
},
|
|
"metric": {
|
|
"enum": ["conversion_from_start", "conversion_from_previous"],
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"default": "FunnelsAlertConfig",
|
|
"enum": ["FunnelsAlertConfig"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["metric"],
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"check_ongoing_interval": {
|
|
"anyOf": [
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "When true, anchor on the trailing (possibly still accumulating) bucket instead of the last complete one."
|
|
},
|
|
"type": {
|
|
"default": "MetricsAlertConfig",
|
|
"enum": ["MetricsAlertConfig"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
],
|
|
"description": "Per-insight-kind alert config, discriminated by ``type`` — keeps the OpenAPI (and the\ngenerated frontend types and MCP tool schemas) in sync with every kind alerts support."
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Per-insight-kind alert configuration, discriminated by `type`. TrendsAlertConfig: series_index (which series to monitor) and check_ongoing_interval (whether to check the current incomplete interval). InsightsQLAlertConfig (SQL insights): column (which result column to evaluate, defaults to the single numeric column), evaluation ('last_row' checks the latest value of an oldest->newest query, 'first_row' checks the first value of a newest->oldest query, 'any_row' fires if any row breaches), and label_column (names the evaluated row(s) in breach messages, in every evaluation mode). FunnelsAlertConfig (funnel insights): funnel_step (the step to monitor, null for the overall last step), metric ('conversion_from_start' or 'conversion_from_previous'), and check_ongoing_interval (historical-trend funnels: also evaluate the current in-progress period). Steps funnels support only absolute_value conditions; historical-trend funnels also support relative_increase/relative_decrease (compared against the prior period)."
|
|
},
|
|
"detector_config": {
|
|
"anyOf": [
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"detectors": {
|
|
"description": "Sub-detector configurations (minimum 2)",
|
|
"items": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold [0-1]. Points above this probability are flagged (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "zscore",
|
|
"enum": ["zscore"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size for calculating mean/std (default: 30)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold [0-1]. Points above this probability are flagged (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "mad",
|
|
"enum": ["mad"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size for calculating median/MAD (default: 30)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"multiplier": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "IQR multiplier for fence calculation (default: 1.5, use 3.0 for far outliers)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"type": {
|
|
"default": "iqr",
|
|
"enum": ["iqr"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size for calculating quartiles (default: 30)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"lower_bound": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Lower bound - values below this are anomalies"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"type": {
|
|
"default": "threshold",
|
|
"enum": ["threshold"],
|
|
"type": "string"
|
|
},
|
|
"upper_bound": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Upper bound - values above this are anomalies"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "ecod",
|
|
"enum": ["ecod"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "copod",
|
|
"enum": ["copod"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"n_estimators": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of trees in the forest (default: 100)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "isolation_forest",
|
|
"enum": ["isolation_forest"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"method": {
|
|
"anyOf": [
|
|
{
|
|
"enum": ["largest", "mean", "median"],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Distance method: 'largest', 'mean', 'median' (default: 'largest')"
|
|
},
|
|
"n_neighbors": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of neighbors to consider (default: 5)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "knn",
|
|
"enum": ["knn"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"n_bins": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of histogram bins (default: 10)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "hbos",
|
|
"enum": ["hbos"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"n_neighbors": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of neighbors for LOF (default: 20)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "lof",
|
|
"enum": ["lof"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kernel": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "SVM kernel type (default: \"rbf\")"
|
|
},
|
|
"nu": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Upper bound on training errors fraction (default: 0.1)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "ocsvm",
|
|
"enum": ["ocsvm"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "pca",
|
|
"enum": ["pca"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"type": "array"
|
|
},
|
|
"operator": {
|
|
"description": "How to combine sub-detector results",
|
|
"enum": ["and", "or"],
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"default": "ensemble",
|
|
"enum": ["ensemble"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["detectors", "operator"],
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold [0-1]. Points above this probability are flagged (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "zscore",
|
|
"enum": ["zscore"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size for calculating mean/std (default: 30)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold [0-1]. Points above this probability are flagged (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "mad",
|
|
"enum": ["mad"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size for calculating median/MAD (default: 30)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"multiplier": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "IQR multiplier for fence calculation (default: 1.5, use 3.0 for far outliers)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"type": {
|
|
"default": "iqr",
|
|
"enum": ["iqr"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size for calculating quartiles (default: 30)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"lower_bound": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Lower bound - values below this are anomalies"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"type": {
|
|
"default": "threshold",
|
|
"enum": ["threshold"],
|
|
"type": "string"
|
|
},
|
|
"upper_bound": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Upper bound - values above this are anomalies"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "ecod",
|
|
"enum": ["ecod"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "copod",
|
|
"enum": ["copod"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"n_estimators": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of trees in the forest (default: 100)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "isolation_forest",
|
|
"enum": ["isolation_forest"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"method": {
|
|
"anyOf": [
|
|
{
|
|
"enum": ["largest", "mean", "median"],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Distance method: 'largest', 'mean', 'median' (default: 'largest')"
|
|
},
|
|
"n_neighbors": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of neighbors to consider (default: 5)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "knn",
|
|
"enum": ["knn"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"n_bins": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of histogram bins (default: 10)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "hbos",
|
|
"enum": ["hbos"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"n_neighbors": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of neighbors for LOF (default: 20)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "lof",
|
|
"enum": ["lof"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"kernel": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "SVM kernel type (default: \"rbf\")"
|
|
},
|
|
"nu": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Upper bound on training errors fraction (default: 0.1)"
|
|
},
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "ocsvm",
|
|
"enum": ["ocsvm"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"preprocessing": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"diffs_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)"
|
|
},
|
|
"lags_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Number of lag features. 0 = none, >0 = include n lagged values (default: 0)"
|
|
},
|
|
"smooth_n": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Preprocessing transforms applied before detection"
|
|
},
|
|
"threshold": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Anomaly probability threshold (default: 0.9)"
|
|
},
|
|
"type": {
|
|
"default": "pca",
|
|
"enum": ["pca"],
|
|
"type": "string"
|
|
},
|
|
"window": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Rolling window size — how many historical data points to train on (default: based on calculation interval)"
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
],
|
|
"description": "Detector configuration types"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"enabled": {
|
|
"description": "Whether the alert is actively being evaluated.",
|
|
"type": "boolean"
|
|
},
|
|
"insight": {
|
|
"description": "Insight ID monitored by this alert. Note: Response returns full InsightBasicSerializer object.",
|
|
"type": "number"
|
|
},
|
|
"investigation_agent_enabled": {
|
|
"description": "When enabled, an investigation agent runs on the state transition to firing and writes findings to a Notebook linked from the alert check. Only effective for detector-based (anomaly) alerts.",
|
|
"type": "boolean"
|
|
},
|
|
"investigation_gates_notifications": {
|
|
"description": "When enabled (and investigation_agent_enabled is on), notification dispatch is held until the investigation agent produces a verdict. Notifications are suppressed when the verdict is false_positive (and optionally when inconclusive). A safety-net task force-fires after a few minutes if the investigation stalls.",
|
|
"type": "boolean"
|
|
},
|
|
"investigation_inconclusive_action": {
|
|
"description": "How to handle an 'inconclusive' verdict: whether gated notifications fire and whether the investigation surfaces in the Signals inbox. 'notify' is the safe default — an agent that can't be sure is itself useful signal. False positives never reach the inbox regardless of this setting.\n\n* `notify` - Notify\n* `suppress` - Suppress",
|
|
"enum": ["notify", "suppress"],
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"description": "Human-readable name for the alert.",
|
|
"maxLength": 255,
|
|
"type": "string"
|
|
},
|
|
"schedule_restriction": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"blocked_windows": {
|
|
"description": "Blocked local time windows when the alert must not run. Overlapping or identical windows are merged when saved. At most five windows before normalization; empty array clears quiet hours.",
|
|
"items": {
|
|
"properties": {
|
|
"end": {
|
|
"description": "End time HH:MM (24-hour). Exclusive (half-open interval). Each window must span ≥ 30 minutes locally.",
|
|
"type": "string"
|
|
},
|
|
"start": {
|
|
"description": "Start time HH:MM (24-hour, project timezone). Inclusive. Each window must span ≥ 30 minutes on the local daily timeline (half-open [start, end)).",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["start", "end"],
|
|
"type": "object"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": ["blocked_windows"],
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Blocked local time windows (HH:MM in the project timezone). Interval is half-open [start, end): start inclusive, end exclusive. Use blocked_windows array of {start, end}. Null disables."
|
|
},
|
|
"skip_weekend": {
|
|
"anyOf": [
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Skip alert evaluation on weekends (Saturday and Sunday, local to project timezone)."
|
|
},
|
|
"snoozed_until": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Snooze the alert until this time. Pass a relative date string (e.g. '2h', '1d') or null to unsnooze."
|
|
},
|
|
"subscribed_users": {
|
|
"description": "User IDs to subscribe to this alert. Note: Response returns full UserBasicSerializer object.",
|
|
"items": {
|
|
"type": "number"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"threshold": {
|
|
"description": "Threshold configuration with bounds and type for evaluating the alert.",
|
|
"properties": {
|
|
"configuration": {
|
|
"description": "Threshold bounds and type. Includes bounds (lower/upper floats) and type (absolute or percentage). For threshold-based alerts (no detector_config), at least one of lower or upper must be set.",
|
|
"properties": {
|
|
"bounds": {
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"lower": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Alert fires when the value drops below this number."
|
|
},
|
|
"upper": {
|
|
"anyOf": [
|
|
{
|
|
"type": "number"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Alert fires when the value exceeds this number."
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"type": {
|
|
"description": "Whether bounds are compared as absolute values or as percentage change from the previous interval.",
|
|
"enum": ["absolute", "percentage"],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["type"],
|
|
"type": "object"
|
|
},
|
|
"created_at": {
|
|
"format": "date-time",
|
|
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"description": "Optional name for the threshold.",
|
|
"maxLength": 255,
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["configuration"],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"required": ["insight", "subscribed_users", "threshold"],
|
|
"type": "object"
|
|
}
|