Adaptive Baselines

Per-day-of-week Random Cut Forest models learn that "Mondays are busier than Sundays." Separate baselines per day eliminate weekly-pattern false positives, and the models adapt continuously — no retraining needed.

Each metric subscription gets its own model that maintains a sliding window of recent values. After the baseline period, the detector computes a z-score-based anomaly score (0–10) for each new datapoint; scores above the configurable threshold (default 3.0) trigger alerts. Daily patterns, gradual drift, and weekly cycles are learned automatically.

How day-of-week baselines work

The detector maintains separate baselines for each day (Monday through Sunday). Each day builds its own sliding window of normal values over time. After roughly one week, the system distinguishes "Monday morning traffic" from "Sunday night quiet" and scores accordingly. Until per-day data is sufficient, it falls back to an overall baseline.

Metrics that emit fewer than ~15 datapoints per day (for example, daily billing or Trusted Advisor checks) use an aggregate baseline across all days rather than per-day-of-week patterns. They are still scored normally — there just isn't enough data to distinguish one weekday from another.

Training period

The detector begins alerting after about 15 data points (~75 minutes), while full training requires 288 points per day-of-week (~24 hours per weekday). During early training, low-confidence alerts are flagged and the training percentage is shown. To suppress alerts entirely during initial learning, set the baselineDays field on the subscription.

Direction and static thresholds

You can filter which deviations alert — high-only, low-only, or both. For absolute limits, pair anomaly detection with static "Alert if below / Alert if above" thresholds that fire immediately regardless of learned behavior.

Related tiers: adaptive baselines are available on all tiers; the baseline period is 7 days on most tiers and 14 days on advanced and above.