'Simulate how many incidents would have generated on different anomaly detections settings

Dear KQL master/ expert, I've been trying to find the most effective (elegant) solution to achieve what I'm trying to do. I'd like to hear from the community, thank you.

Situation:

  • Currently we have an anomaly detection rules named "Process execution frequency anomaly" running every hour, and generated a lot of false-positives
  • We would like to tune the analytic rule by changing "threshold" value in series_decompose_anomalies.
  • We would like to simulate the analytic rule running various different settings, to see how much incident it would be generated.

Issue/ Things I tried:

  • The idea was to simulate "as if" the analytic rule is running every hour 7 days back for example. Similar to "Result simulation" section.
  • I have been able to create a simulation in Workbooks for simple analytic rules, by adding make-series command at the end of the KQL line. However, for this specific anomaly detection rules, I haven't been able to recreate it. Most likely because the data is produced by series_decompose_anomalies function in memory.

Question:

  • Is it doable?
  • Did I approach this incorrectly?
  • Is it best to change the settings, and then do an evaluation in the next 30 days ?

Thank you for your thoughts and suggestions.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source