'Simulate how many incidents would have generated on different anomaly detections settings
Dear KQL master/ expert, I've been trying to find the most effective (elegant) solution to achieve what I'm trying to do. I'd like to hear from the community, thank you.
Situation:
- Currently we have an anomaly detection rules named "Process execution frequency anomaly" running every hour, and generated a lot of false-positives
- We would like to tune the analytic rule by changing "threshold" value in series_decompose_anomalies.
- We would like to simulate the analytic rule running various different settings, to see how much incident it would be generated.
Issue/ Things I tried:
- The idea was to simulate "as if" the analytic rule is running every hour 7 days back for example. Similar to "Result simulation" section.
- I have been able to create a simulation in Workbooks for simple analytic rules, by adding make-series command at the end of the KQL line. However, for this specific anomaly detection rules, I haven't been able to recreate it. Most likely because the data is produced by series_decompose_anomalies function in memory.
Question:
- Is it doable?
- Did I approach this incorrectly?
- Is it best to change the settings, and then do an evaluation in the next 30 days ?
Thank you for your thoughts and suggestions.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
