Kaituo Li

So far we don't.

Yes, it is post-processing of AD results. We may be able to do these in alerting and AD UX. Updated the rfc to reflect that.

Example failed runs: https://github.com/opensearch-project/anomaly-detection/runs/3932847389 and https://github.com/opensearch-project/anomaly-detection/runs/3725802443

sent the PR to fix the issue: https://github.com/opensearch-project/anomaly-detection/pull/1258 My solution is a little different: * When suggesting interval, I am using cold start queries if the feature exist (it is...

close the issue for now. @amitgalitz feel free to reopen if you find my PR needs improvement.

> > > The model produces too many spurious warnings. > > > The model misses too many anomalies. > > > The data point is not an anomaly (false...

> > > Next, the user reviews the results of different changes on hyperparameters or feature weights. > > will the customer review the parameters or AD results from the...

@ylwu-amzn @sudiptoguha We still have external shingling for single-stream detectors. So shingle size will matter on the model memory size. For example, with external shingling, dimension = 60, shingle size...

Discussed with Sudipto and Sean, we need to have a cap of shingle size due to memory and long latency issues. There is a code path triggering external shinling, so...

Possible improvement: total_entities: cardinality of categorical fields in the past x intervals. active_entities: number of entities in the past interval using cardinality aggregation. model_count: active models