Data implications of auto-creating Anomaly Detections

Suppose your Discover environment contains 1000 events and 500 whitelisted values in dimensions that are referenced by those events. The following sections provide some metrics on the impacts of auto-creating Anomaly Detections and maintaining those Anomaly Detections in your environment.

  • Each event and each event + whitelisted dimension value requires one calculation.
    • If the same dimension is referenced in two events, the Anomaly Detection calculations for that dimension are performed twice.
  • For 1000 events, each with 500 whitelisted values, the number of calculations is 500,000.