Review, manage, and act on detected anomalies by renaming or dismissing them, assigning owners, filtering affected systems, and using available tools to investigate or resolve issues.
Video Transcript
Let's walk through the different parts of the Anomaly Details page. When an anomaly is first detected, it is given a default name, which is a shortened version of the anomaly ID. The full anomaly ID appears under the name. The detection date is shown at the end and is not part of the name. You can rename the anomaly by clicking Rename Anomaly and entering a new name. Anomaly names cannot contain spaces but may include underscores.
Anomalies can be dismissed by clicking Dismiss Anomaly. This is useful if the issue is already known or is a false positive. The anomaly is removed from the active list but continues to be monitored until it is resolved.
You can leave feedback on whether the anomaly was correctly identified and why. Choose the thumbs‑up or thumbs‑down icon, then enter a brief explanation. This option disappears after you respond. Feedback is optional but helps improve anomaly detection accuracy.
Using the information in the tiles, you can see how many systems the anomaly was detected on and the duration of the anomaly. The anomaly status can be active, resolved, or dismissed. You can optionally assign the anomaly to someone so they know to monitor it. Click the plus sign to open a window with a dropdown list of all users who have access to Prevent and Anomalies. To remove an assignee, click the circle next to their name.
The system grid lists all affected systems by default. You can filter it to view only active, monitoring, or recovered systems. The Take Action button allows you to run automations, engagements, surveys, or alerts on the systems listed in the grid.
The Online column indicates whether systems are offline, connected, or cached. The activity feed shows when the anomaly was first detected, when it appeared on additional devices, and when those devices recovered.
At the bottom of the page are two charts:
The first shows sensor activity related to the anomaly.
The second shows the number of active and recovered devices over time.
Return to the Anomalies dashboard by clicking the orange arrow.