Data Analytics · Read + Write

Anomaly detection & smart notification

Automate Rep · High Reason · High

The problem

Sales / ops dashboards are reviewed once a week — by then a 30% drop has festered for days. Threshold alerts ("revenue < X") fire on noise; teams stop reading them.

The AI approach

Forecast + residual: model expected value; flag when actual deviates beyond confidence band. LLM writes a one-line plain-English alert with the most likely cause from joined dimensions.

The outcome

~3-day faster

Mean time-to-notice drops from ~3 days → ~2 hrs. False-positive rate stays < 1 / week — alerts get read.

Try itInput → Process → Output

Input — daily revenue stream
store_07 · revenue · last 30 days
120 80 40 −42%
Process — AI pipeline
1Forecast expected bandReadPredictive
2Score residual + isolationReadPredictive
3Apply alert + suppression rulesRulesSymbolic
4Write & send Slack alertWriteGenerative
Output — alert to person in charge
Click Run demo to fit the band, score the latest day, and route an alert.
AI
anomaly-watcher#ops-store-07 · just now
⚠ Revenue anomaly · store_07
Yesterday's revenue was 54k, vs. expected 92k ± 6k — a −42% drop, well below the 95% confidence band. Likely cause: weekend foot-traffic anomaly (rain · joined from weather table). Cc: @khun-ploy (store manager).
z-score−6.34routestore_mgrsuppress24h

Three AI types in this use case

SymbolicAlert rules (z-score > 3), suppression windows, escalation paths — who is paged when.
PredictiveTime-series forecast (Prophet / DeepAR) + isolation forest / autoencoder reconstruction.
GenerativeLLM writes the natural-language alert summary with the most likely cause.

The stack

  • Forecaster · Prophet / DeepAR / NeuralProphet
  • Detector · Isolation Forest / autoencoder
  • Routing · Python rules → Slack/email/SMS
  • Narrator · Claude / GPT for the alert text

When this works

  • Series has a stable seasonal pattern to fit
  • You can name who is on the hook per metric
  • Joined context (calendar, weather, promos) is available
  • Alerts go to a channel people already read

When it fails

  • Concept drift — the baseline shifts; refit on rolling window
  • Alert fatigue — too many channels → muted
  • One-off events (Black Friday) flagged every year
  • Owner ambiguity — alert lands in #general → no one acts