> ## Documentation Index
> Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt
> Use this file to discover all available pages before exploring further.

# What is Anomaly Detection?

> Anomaly Detection watches your services and notifies you when behavior deviates from normal, without requiring you to define thresholds in advance.

export const HnyIcon = ({alias, path, size = 16, iconColor}) => {
  const iconMap = {
    "home": "house.svg",
    "marker": "caretFilledDown.svg",
    "show-marker-options": "chatTextLeft.svg",
    "download": "arrowLineDown.svg",
    "trace-waterfall": "trace.svg",
    "show-query-details": "listDashes.svg",
    "table": "table.svg",
    "log-lines": "logLines.svg",
    "chart": "chartLine.svg",
    "show-settings": "gear.svg",
    "add": "plus.svg",
    "remove": "delete.svg",
    "persist": "caretDown.svg",
    "close": "close.svg",
    "copy": "copy.svg",
    "zoom-in": "magnifyingGlassPlus.svg",
    "zoom-out": "magnifyingGlassMinus.svg",
    "color-assignment": "drop.svg",
    "drag": "dots-six-vertical.svg",
    "drawer": "drawer.svg",
    "show-actions": "dotsThree.svg",
    "edit": "pencil.svg",
    "delete": "trash.svg",
    "move": "arrowsOutCardinal.svg",
    "show-legend": "circleInfo.svg",
    "usage-ok": "usageGood.svg",
    "usage-warning": "usageWarning.svg",
    "usage-danger": "usageDanger.svg",
    "open-query-builder": "query.svg",
    "home-menu": "house.svg",
    "query-menu": "query.svg",
    "boards-menu": "board.svg",
    "triggers-menu": "bell.svg",
    "slos-menu": "handshake.svg",
    "service-map-menu": "serviceMap.svg",
    "history-menu": "clockCounterClockwise.svg",
    "manage-data-menu": "cube.svg",
    "usage-menu": "usageGood.svg",
    "canvas-menu": "sparkle.svg",
    "anomalies-menu": "anomalies.svg",
    "show-details": "dotsThreeVertical.svg",
    "resize-handle": "board-panel-resize-handle.png",
    "standard-dataset": "cube.svg",
    "trace-dataset": "cubeChat.svg",
    "all-datasets": "linkedSquares.svg",
    "share": "arrowBentRight.svg",
    "run-in-query-builder": "arrowSquareUpRight.svg",
    "link": "link.svg",
    "text": "text.svg",
    "receive": "arrowLineDown.svg",
    "process": "lightning.svg",
    "sample": "drop.svg",
    "send": "arrowLineUp.svg",
    "submit": "arrowUp.svg",
    "canvas-menu": "sparkle.svg",
    "canvas": "sparkle.svg",
    "chat-about-this-page": "sparkle.svg",
    "private": "lockKey.svg",
    "shared": "people.svg",
    "expand": "caretDown.svg",
    "previous": "caretLeft.svg",
    "next": "caretRight.svg",
    "expand-chat": "caretLeft.svg",
    "minimize-chat": "caretRight.svg",
    "open-in-canvas": "arrowSquareUpRight.svg",
    "send-test": "EnvelopeSimple.svg"
  };
  const iconBasePath = "/_assets/icons/";
  const iconPath = path || (alias ? `${iconBasePath}${iconMap[alias]}` : undefined);
  return <span className="hny-icon" style={{
    display: "inline-block",
    width: `${size}px`,
    height: `${size}px`,
    maskImage: `url(${iconPath})`,
    maskSize: "contain",
    maskRepeat: "no-repeat",
    maskPosition: "center",
    WebkitMaskImage: `url(${iconPath})`,
    WebkitMaskSize: "contain",
    WebkitMaskRepeat: "no-repeat",
    WebkitMaskPosition: "center",
    backgroundColor: iconColor || "var(--hny-icon-color)",
    verticalAlign: "middle"
  }} />;
};

<Badge className="hny-badge-beta">Beta</Badge>

Anomaly Detection watches your services and tells you when something is worth investigating.
It builds a statistical baseline of normal behavior for each service, then notifies you when behavior deviates from that baseline, so you can catch problems without predicting a failure mode or setting a threshold in advance.

## What you can do

With Anomaly Detection, you can:

* Catch a failure mode you haven't written a Trigger for, since Anomaly Detection doesn't require you to predict what could go wrong.
* Find out when a service stops sending data entirely.
* Get error rate coverage across many services without hand-configuring a threshold for each one.
* Hand an anomaly straight to a Canvas investigation, so a likely cause is waiting by the time you look.

For step-by-step investigation guides, visit:

* [Investigate an Error Rate Anomaly](/notify/anomaly-detection/use-cases/investigate-error-rate/)
* [Diagnose a Silent Outage](/notify/anomaly-detection/use-cases/diagnose-silent-outage/)

## How it works

Honeycomb runs a continuous cycle for each monitored service, then surfaces the results through a set of states, an eligibility check, and a sensitivity threshold you control.

### The detection cycle

For each monitored service, Anomaly Detection runs these steps:

1. **Onboarding**: Honeycomb identifies eligible services automatically and enrolls them using their existing historical data.
   Honeycomb then builds a statistical baseline from that historical data, defining what normal looks like for the service.
   (Honeycomb will continue to analyze services and signals for eligibility, traffic patterns, and detection, so the baseline adapts as a service's behavior evolves.)
2. **Aggregate**: Honeycomb continuously aggregates the relevant signal in real time.
3. **Detect**: Honeycomb compares live values against the baseline and, when a sustained deviation occurs, flags an anomaly and sends a notification.

The baseline assumes relatively stable traffic.
Services with strong daily or weekly cycles, such as predictable weekday spikes, can generate false positives until seasonality support ships.

### Signals

Anomaly Detection currently covers two signals, built on Events data for services:

| Signal         | What it detects                                                                                               |
| -------------- | ------------------------------------------------------------------------------------------------------------- |
| **Error rate** | The service's error rate deviates significantly from its historical baseline.                                 |
| **Presence**   | The service's data stream disappears entirely, for example after a failed deployment or a broken integration. |

### Service states

Each service shows one of the following states, reflecting its current eligibility and monitoring status:

| State            | Description                                                                                                                                                         |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Onboarding**   | The service was recently identified as eligible and is still accumulating data before detection starts.                                                             |
| **Normal**       | The service is eligible for monitoring, turned on, and currently free of active anomalies.                                                                          |
| **Anomalous**    | The service is eligible, turned on, and has an anomaly currently active.                                                                                            |
| **Ineligible**   | The service has too little continuous data for reliable detection. Honeycomb pauses monitoring automatically and resumes it on its own once data coverage recovers. |
| **Off / Paused** | Monitoring was manually turned off. You can re-enable the service at any time.                                                                                      |

### Service eligibility

Honeycomb evaluates services against a rolling data coverage window to decide whether detection is likely to produce meaningful results.
Ineligible services remain visible in your services list, so you can see your full coverage picture along with the reason a given service isn't monitored yet.

### Sensitivity thresholds

Each signal has its own sensitivity control:

* **Error rate**: Uses a named sensitivity threshold (high, medium (default), or low).
* **Presence**: Uses a time-based threshold, set to five minutes by default, that determines how long a service's data stream can go quiet before Honeycomb flags it as an anomaly.

### MCP support

Anomaly Detection service profiles are available through the Honeycomb MCP server, so agents can pull anomaly status alongside service map data.
To learn more, visit [Service Map and Anomalies](/integrations/mcp/tools#service-map-and-anomalies-2).

## Choosing between Anomaly Detection, Triggers, and BubbleUp

Which tool fits depends on how much you already know about the problem:

* **You already know what could go wrong and want to set a specific threshold**: Use a [Trigger](/notify/triggers/).
  Triggers are static: you define the condition, and Honeycomb checks your data against it.
* **You already know something is wrong and need to find why**: Use BubbleUp.
  Select the unusual region of data, and BubbleUp highlights which dimensions differ most from the baseline.
* **You want Honeycomb to tell you what to watch for**: Use Anomaly Detection.
  It learns what normal looks like for a service and alerts you when something changes, with no configuration required.

These tools work together, each covering a different stage of the same investigation.
When Anomaly Detection surfaces an anomaly, it can automatically start a Canvas investigation that surfaces a likely cause, so diagnosis is already underway by the time you look.
To learn how to set up auto-investigation, visit [Auto-investigate Anomalies](/investigate/canvas/auto-investigate#anomaly-detections).

## Next steps

* To get started with a service, visit [Get Started with Anomaly Detection](/notify/anomaly-detection/get-started/).
* For real-world scenarios, visit:
  * [Investigate an Error Rate Anomaly](/notify/anomaly-detection/investigate-error-rate/)
  * [Diagnose a Silent Outage](/notify/anomaly-detection/diagnose-silent-outage/)