Anomalies
Anomalies (Intelligence → Anomalies) lists readings that deviated from what is normal for a particular machine. It also appears as a tab inside Compliance; this screen gives it more room, filters, and clearer labelling.
How to read an anomaly
Section titled “How to read an anomaly”Every card separates three kinds of statement, because they are not equally trustworthy:
| Label | What it is | How much to trust it |
|---|---|---|
| Measured | Numbers Guardian read from the machine — for example CPU 94.0% vs baseline 28.1%. | Facts about what was observed. |
| Detected | The fixed rule that flagged it: the reading was more than 2.5 standard deviations from the machine’s own rolling 7-day baseline, shown as 3.2σ above. | Deterministic and checkable against the measurement. |
| AI interpretation · not verified | Text generated by a language model that tries to explain the cause. | A hypothesis. It can be wrong; compare it with the measurements before acting on it. |
An anomaly with no AI text simply has none — Guardian doesn’t generate placeholders. If AI explanations aren’t configured on your platform, you will only see the first two rows.
Finding what matters
Section titled “Finding what matters”Anomalies are grouped by machine, with the worst severity first. Use Severity, Metric and Host to narrow the list; the counter shows how many of the total match. View in Agents opens the machine in the Agents screen. The list shows the most recent 50 anomalies and refreshes every minute; if a refresh fails, the page keeps the last data and tells you how old it is.
When there are none
Section titled “When there are none”No anomalies means every monitored reading is within its normal range. Baselines need about seven days of history, so a newly enrolled machine can’t produce anomalies yet.
Related
Section titled “Related”- Compliance Checks
- Alerts for threshold-based alerting, which works alongside anomaly detection
- Agents