Overview

The threshold of a monitor defines the logic Sifflet uses to decide whether a data point is normal or an anomaly. When you configure a monitor, you choose one of three threshold types:

• Static: The data point must stay within fixed limits that you define.
• Relative: The data point must not change too much compared to the value from the previous time window.
• Dynamic: A machine learning (ML) model learns the expected behavior of your data and flags data points that deviate from it.

The threshold types available depend on the monitor template. See the Template Library for the options of each template.

Static Thresholds

Static thresholds are fixed limits. You set a minimum, a maximum, or both, and Sifflet raises an alert when the monitored value falls outside these boundaries.

Use static thresholds for known business cases and strict rules. For example:

• A product price can never be negative: set a minimum of 0.
• Your data contract states that a table must be refreshed by 9am every day: define a Freshness monitor that runs at 9am with a threshold of 24 hours.

Relative Thresholds

Relative thresholds compare the current data point with the value from the previous time window, rather than with absolute limits or long-term trends. Sifflet raises an alert when the change exceeds the range you define.

Use relative thresholds to catch sudden variations between consecutive data points. You can express the change in two ways:

• Relative percentage: The change is a percentage of the previous value. For example, alert when the row count increases or decreases by more than 5% compared to the previous day.
• Relative absolute: The change is the difference between the two values, in the same unit as the monitored value. For example, alert when the row count increases or decreases by more than 100 rows.

You can set a lower bound, an upper bound, or both.

Dynamic Thresholds

With dynamic thresholds, Sifflet trains an ML model on the history of your monitor results. The model learns the expected patterns of your data, including growth and seasonality, and computes a confidence band for each data point. Sifflet raises an alert when a data point falls outside this band.

Use dynamic thresholds when you don't have specific limits but still want to catch abnormal behavior, such as sudden drops or unexpected spikes. They're also the recommended choice when you monitor many tables at scale, since you don't need to tune limits by hand for each one.

Training History

The model trains on a history of recorded data, 365 days by default. Choose a training history that covers the business periodicity you want the model to detect. For more information, see Monitor Setup.

Tuning Dynamic Thresholds

You can adjust how the model behaves with the following features:

• Sensitivity: Defines how far a value must deviate before Sifflet flags it as an anomaly. Lower the sensitivity to reduce false positives and alert only on significant events, or raise it to catch subtle deviations.
• Feedback Loop: Qualify data points (for example, as false positives or false negatives) to add your own input to the model training and improve its accuracy over time.
• Special Dates Handling: Select calendars of excluded dates, such as public holidays, so that Sifflet doesn't report anomalies on days when you already expect unusual data.