> For the complete documentation index, see [llms.txt](https://docs.nuvens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nuvens.cloud/admin/admin-section/anomaly-detection.md).
# Anomaly Detection
**Anomaly Detection** automatically identifies unusual behaviour across your WorkSpaces environment by analysing performance metrics and comparing them against historical baselines and similar WorkSpaces.
Anomalies are generated when a WorkSpace exhibits behaviour that significantly deviates from normal operating patterns, helping administrators proactively identify performance issues, resource bottlenecks, or potential user-impacting problems.
To access **Anomaly Detection**, ensure the **Anomalies Detected** tile is enabled on the [**Admin Dashboard**](/admin/admin-section/admin-dashboard.md). Click **Customize** and verify the tile is selected. Once enabled, the tile will appear on the dashboard and can be used to access by clicking it.
The Anomaly Detection displays:
* **Date (UTC)** – When the anomaly was detected.
* **WorkSpace** – The affected WorkSpace.
* **User** – The associated user account.
* **Metric** – The metric that triggered the anomaly (**CPU**, **RAM**, **Latency**, **Disk**, **Process** or **Startup Time**).
* **Observed** – The actual value recorded.
* **Score** – The anomaly score calculated by the detection engine.
* **Severity** – Indicates the significance of the anomaly (**Low**, **Medium** or **High**).
* **Status** – Current anomaly status (**New**, **Acknowledged**, **Suppressed** or **Closed**).
Administrators can filter anomalies by **metric**, **severity**, **status**, and **date range** to focus on specific events.
{% hint style="warning" %}
The actions next to the filters are bulk actiions that apply to all anomalies returned by the current filter. To manage a single anomaly, use the action buttons in the **Actions** column.
{% endhint %}
{% hint style="info" %}
Hover over an **Observed** value to view the evidence associated with the anomaly. This provides additional information about the specific condition that triggered the alert, such as a high latency or RAM spike
{% endhint %}
Click **Useful Information** to view detailed information on how anomaly scores and severity levels are calculated, including:
* Severity thresholds
* Z-Score calculations
* P95 Spike detection
* Low Disk alerts
* Process Spike detection
This information helps administrators understand why an anomaly was generated and how the severity was determined.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.nuvens.cloud/admin/admin-section/anomaly-detection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.