📘

Changes - October 2024

Expected & False Positive have been merged into False Positive / Expected

Known Error has been changed to No action needed / Known Error

Reviewed has been added.

Overview

Sifflet ML models offer a way to introduce user-generated input into the training information in a form of a Feedback Loop.

Description

Qualifications

By providing feedback on alerts, it's possible to improve models accuracy. Currently available qualifications are:

• False Positive / Expected - A data point was falsely detected as an anomaly. This can be used to flag points just outside the confidence band or to tell the model that the trend has changed, for example when entering a busy period, and avoid anomalies.
• False Negative - there is an anomaly in data, but the model has not raised it.
• Reviewed - A neutral qualification indicating
• Fixed - The anomaly has been fixed. Sifflet can automatically qualify datapoints as fixed if they were previously anomalies and have been rechecked as part of the lookback period.
• No Action Needed/ Known Error - This qualification can be used to flag known issues that won't be fixed or don't need to be fixed. The model will ignore this data point.

📘

Data point qualification influence on the model

Strong influence

When qualifying a data point as false positive/Expected, false negative, Sifflet will update the model to attempt to detect/not detect similar points as anomalies

Normal influence

When qualifying a data point as fixed, the model will include it into the training dataset, however, it won't create a subsample to train a model on around it. When qualifying a data point as No Action Needed/Known error, the model will ignore it in the training process.

No influence

When qualifying a data point as Reviewed, the model will act as normal and not change it's behaviour based on the qualification.

Usage

It's possible to qualify a data point by simply clicking on it. A qualification modal will be displayed.

Examples

Example 1

In the case below, big drops have been identified in September. After investigation, the root cause has been identified by your team but won't fix it for now. Since it will not be fixed any time soon, and in order to avoid impacting future predictions, you can set the Qualification to "No Action Needed/Known Error".

Example 2

In the case below, an alert has been identified. After investigation, it appears that the alert was inaccurate because the increase and change in trend is an expected business shift.

In order to improve future predictions and avoid anomaly noise, a Qualification to "False Positive / Expecetd" should be applied. As we can see in the example, the model quickly tries to adapt to higher expectedvalues.