XenonStack Blog Real-Time Anomaly Detection: Methods and Architecture

Real-time anomaly detection means scoring each new event, metric or log line against a learned notion of normal while the data is still arriving, so that an operator or an automated workflow can act before the deviation becomes an outage, a breach or a loss. It is different from a nightly report: the value sits in the minutes between the deviation and the damage. This guide explains the methods, the architecture and the decisions an enterprise team has to make, and links to our deeper anomaly detection use case.

The short answer for most teams: start with statistical baselines on a few critical streams, add unsupervised models where labels do not exist, use deep learning for time series with complex seasonality, and treat alert routing, root cause and human approval as part of the system rather than an afterthought. For images and video, see our separate guide to anomaly detection in images and videos.

Key Takeaways

• An anomaly is a deviation from expected behaviour, such as a server outage, a data leak, a fraudulent transaction or a network intrusion. Whether a value is anomalous often depends on time and context.
• Pick the method by label availability: supervised models need labelled history, unsupervised models need none, and novelty detection needs a clean training set (scikit-learn documentation).
• Detection alone is not enough. Correlation analysis finds the cause, and predictive models act before failure.
• A production platform needs five parts: data collection, aggregation, visualisation, alerting and analytics. Add governance: who may act on an alert, and with what evidence.
• Check managed-service status before you commit. Azure AI Anomaly Detector was scheduled to retire on 1 October 2026, and Amazon Lookout for Metrics support ended on 10 October 2025.

What is real-time anomaly detection and what has changed?

Ten years ago analytics meant spreadsheets, SQL databases and reports on customer classes or sales trends. As sensor streams, transactions and application logs grew, serial processing on relational stores could no longer keep up, and teams moved to NoSQL stores and parallel, distributed processing. That shift is the foundation for streaming detection today. The table sets out what changed for decision makers.

Which detection approach fits your data?

The choice depends on whether you hold labelled examples of failure, how clean your history is, and how quickly normal behaviour changes. The scikit-learn documentation separates two situations: outlier detection, where the training data already contains outliers, and novelty detection, where the training data is clean and the aim is to judge new observations. It also notes that outlier detection in high dimensions, or without assumptions about how the normal data is distributed, is very challenging.

Isolation Forest isolates observations by random splits, so anomalies need shorter paths through the trees; scikit-learn describes it as efficient for high-dimensional data. Local Outlier Factor compares the local density of a point with that of its neighbours and so copes with groups of different density. Both are sensible first unsupervised baselines.

How do statistical baselines work on time series?

Log and metric data is a time series, so a value can be normal at one timestamp and anomalous at another. The simplest baseline tracks the mean and standard deviation of a signal such as memory usage or equipment temperature and raises an alert when values move beyond a chosen percentile or when the mean shifts. A simple moving average treats recent and older points equally. An exponential moving average gives recent points more weight: S_t+1 = αy_t + (1 − α)S_t, with 0 < α ≤ 1. Neither is better in general; the choice depends on the signal.

Context matters more than the formula. On a public holiday, usage is expected to be low, so a naive baseline raises false alarms and then learns the holiday as normal for the following day. A common remedy is to replace the off-day values with the values expected on a normal day before the model learns from them, and then tune precision against recall for the business cost of a miss versus a false alarm.

How do you evaluate a real-time detector?

Accuracy on a static test set is not enough for streams. The Numenta Anomaly Benchmark, introduced by Lavin and Ahmad at IEEE ICMLA 2015, is an open-source framework for streaming detectors whose scoring rewards early detection, penalises false alarms, and expects a detector to work across different real-world time-series domains and adapt automatically as the statistics change. Use that framing for your own tests: measure how early the alert fires, how many alerts an operator must dismiss, and how the model behaves after the data drifts.

What does a production anomaly detection platform need?

A production system rests on five parts, plus a sixth that decides whether anyone trusts it.

The platform should also correlate metrics across nodes, virtual machines, containers and applications, so that proactive monitoring and capacity planning draw on the same data. Our guides to real-time analytics architecture and streaming analytics cover the layers in more detail.

How does detection lead to root cause and prediction?

A good detector is the start. The next question is which fields or variables caused the deviation. Correlation analysis answers it: a large download explains a memory spike in the logs, a heavy training job explains CPU usage, and a sudden change in log patterns can point to an unauthorised attempt to enter the network. Our guide to log analytics shows how this works on log data.

The forward-looking step is prediction. Markov models project feature trends over the next k timestamps, and Bayesian classification estimates the probability that a set of conditions leads to an anomaly, giving ranked likelihoods for several failure hypotheses. If a feature is trending towards a failure threshold, a team can repair it before the component fails. See also predictive maintenance to prevent downtime.

The maturity arc runs from detection to correlation, then prediction, then automated optimisation. Agentic operations platforms extend the last step: for example, AgentSRE uses a group of AI agents to spot problems, find their underlying causes and repair them, which is the pattern this arc leads to when humans stay in control of approvals.

Where does real-time anomaly detection apply?

For sensor data the work has three steps: select the features that predict anomalies, transform them so that patterns become visible, and decide which patterns count as an anomaly. Once the loop is automated, nobody needs to watch each machine, and the alert reaches the right person with the evidence. Rule-based alerting works only where domain knowledge is well defined; when hidden patterns drive anomalies, pattern-recognition methods such as DBSCAN and PCA find them without prior domain rules. For a wider view of streaming use cases, read top real-time analytics use cases.

Which managed services have been retired?

Several cloud anomaly detection services have been withdrawn, so check status before you design around one.

The lesson is to keep the detection logic, features and thresholds portable. Open-source libraries such as scikit-learn, Keras and TensorFlow keep the model layer under your control.

What are the trade-offs and when should you not use it?

• False alarms: an alert that nobody trusts is worse than none. Tune thresholds against the cost of a miss and review alert volume weekly.
• Drift: static models trained on a sample go stale as the data changes. Plan retraining and monitor the detector itself.
• Explainability: deep models score well but are harder to defend in an audit. Keep a simpler baseline alongside them.
• Do not automate blindly: where an action is irreversible, such as blocking a payment or shutting down a line, keep a human approver and record the evidence.
• Not needed: for slow-moving, low-risk metrics a daily report and a static threshold are enough.

Governance is what turns an alert into a decision you can defend. ElixirData Context OS keeps governed context, versioned policy and decision traces in one decision layer above AI agents, and ElixirClaw is an agentic OS platform to build, orchestrate and govern AI agents and automation workflows while keeping humans in control. AgentAnalyst lets teams ask questions of enterprise data in plain language and get real-time insights, which helps when an analyst needs to explore an alert.

In what order should an enterprise adopt it?

• 1. Choose two or three critical streams where a missed deviation has a known cost.
• 2. Establish baselines with statistics, then add Isolation Forest or Local Outlier Factor.
• 3. Add context such as calendars, maintenance windows and holidays before tuning thresholds.
• 4. Wire alerting and correlation so each alert carries a likely cause.
• 5. Add prediction where history supports it, and measure early detection and false alarms.
• 6. Automate selectively with human approval and a recorded trail for high-impact actions.

Watch: from alert flood to one incident

This short ElixirClaw video shows how an alert flood of 1,284 alerts is reduced to one incident in 71 seconds, which is the correlation step described above.

AI Incident Detection: 1,284 Alerts, One Incident, 71 Seconds (ElixirClaw)

To map one real-time anomaly decision your agents should make, and the context and policy it depends on, book a Context Workshop. See what happens in the workshop.

Frequently asked questions

What is real-time anomaly detection?

It is scoring each new event or metric against a learned model of normal behaviour as the data arrives, so that deviations such as outages, intrusions or fraud can be acted on before they cause damage.

What is the difference between outlier detection and novelty detection?

In outlier detection the training data already contains outliers. In novelty detection the training data is clean and the aim is to decide whether a new observation is unusual (scikit-learn documentation).

Which algorithm should we try first?

Start with statistical baselines on a few critical streams, then Isolation Forest or Local Outlier Factor if you have no labels. Use supervised models only when you hold labelled anomalies.

How do we evaluate a streaming detector?

Measure how early it alerts, how many false alarms it raises and how it adapts as data changes. The Numenta Anomaly Benchmark scores detectors on these lines.

Is Azure AI Anomaly Detector still available?

Microsoft lists Azure AI Anomaly Detector for retirement on 1 October 2026, so new designs should not depend on it. Amazon Lookout for Metrics support ended on 10 October 2025.

Why keep a human in the loop?

Some actions, such as blocking payments or stopping equipment, are hard to reverse. A human approver and a recorded trail make an automated response defensible.