Anomaly detection (Labs)

Overview

Anomaly detection is a feature that analyzes the performance of devices in your fleet by reporting when critical issues or significant improvements occur as a result of recent network change, a new app deployment, or a device configuration update.

Anomaly detection panel

The Anomaly detection panel appears between the date selector and the tiles on the main Dashboard page. When critical issues or significant improvements — known as “anomalies” — are reported, they appear as notification tiles on a carousel in the panel.

Anomaly detection runs an analysis of your fleet’s data at a pre-defined frequency (depending on the anomaly), and only sends a notification when critical issues or significant improvements are detected. If there are no tiles in the panel, this indicates that no anomalies were detected.

If new anomalies are detected, they are added to the carousel. In the case of multiple anomalies, you can view up to three tiles at a time — with the newest tile on the left — and cycle through each tile with the Next and Previous buttons on the sides of the carousel.

If critical issues are detected, each tile provides the following:

• A description of the issue along with links to view the related dashboard insight. For example, if the issue was related to a specific app version causing excessive abnormal events, you’ll get a link to the Apps with most issues dashboard insight to help you investigate that version further.

• A Next steps link that brings up a report describing the possible factors contributing to the issue, along with steps to help you mitigate or resolve the problems.

• The ability to schedule — depending on the anomaly type — a snapshot or debug log for the top five impacted devices, in order to help you investigate and troubleshoot the cause of the issues in more detail.

If significant improvements are detected, the tiles provide a summary of what was improved, as well as links to the relevant dashboard insight, but no additional actions are available.

After you review a notification, you can dismiss it by clicking the Close icon (x) in the top right corner of a tile. Once a notification is dismissed, it is removed from the carousel. However, you can view all notifications from the last 60 days — including the ones you dismissed — by going to the Anomaly detection history page.

Anomaly detection history

To review all anomalies over the last 60 days, click the > button in the top right corner of the Anomaly detection panel. On the history page, you’ll see every anomaly sorted by date with the newest anomalies on top.

From here, if an anomaly was related to an issue, you can take the same actions as from the Anomaly detection panel:

• Click any View link in the NEXT STEPS column to read about the possible factors contributing to the issue, along with steps to help mitigate or resolve the problems.

• Click any link in the ANOMALY column to go to that anomaly’s related dashboard insight page.

• Click the link in the DIAGNOSTICS DATA column to go to the SNAPSHOTS tab of the Diagnostics page where you can view the status of your requested snapshots or debug logs.

• Select an anomaly from the list and click SCHEDULE DEVICE SNAPSHOT to request a snapshot or debug log for the top five devices impacted by that anomaly. Diagnostic data will be captured from your devices the next time an anomaly occurs.

For anomalies related to an improvement, you’ll just get a summary of the improvement and a link to the related dashboard insight. No additional actions are available for these types of anomalies.

Anomaly insights

The following insights are reported by Anomaly detection:

• App abnormal events