Anomaly Detection

Anomaly Detection automatically identifies unusual behaviour across your WorkSpaces environment by analysing performance metrics and comparing them against historical baselines and similar WorkSpaces.

Anomalies are generated when a WorkSpace exhibits behaviour that significantly deviates from normal operating patterns, helping administrators proactively identify performance issues, resource bottlenecks, or potential user-impacting problems.

To access Anomaly Detection, ensure the Anomalies Detected tile is enabled on the Admin Dashboard. Click Customize and verify the tile is selected. Once enabled, the tile will appear on the dashboard and can be used to access by clicking it.

The Anomaly Detection displays:

• Date (UTC) – When the anomaly was detected.

• WorkSpace – The affected WorkSpace.

• User – The associated user account.

• Metric – The metric that triggered the anomaly (CPU, RAM, Latency, Disk, Process or Startup Time).

• Observed – The actual value recorded.

• Score – The anomaly score calculated by the detection engine.

• Severity – Indicates the significance of the anomaly (Low, Medium or High).

• Status – Current anomaly status (New, Acknowledged, Suppressed or Closed).

Administrators can filter anomalies by metric, severity, status, and date range to focus on specific events.

The actions next to the filters are bulk actiions that apply to all anomalies returned by the current filter. To manage a single anomaly, use the action buttons in the Actions column.

Hover over an Observed value to view the evidence associated with the anomaly. This provides additional information about the specific condition that triggered the alert, such as a high latency or RAM spike

Click Useful Information to view detailed information on how anomaly scores and severity levels are calculated, including:

• Severity thresholds

• Z-Score calculations

• P95 Spike detection

• Low Disk alerts

• Process Spike detection

This information helps administrators understand why an anomaly was generated and how the severity was determined.