Live demo
14 series in. 4 alerts out.
Four vendor APIs, 60 days of your own outbound calls, 14 series. On day 42 the payments vendor deployed. They did not announce it, the status page stayed green, and every affected request returned 200. Find the change.
Every number on this page is computed in your browser right now, by the same CUSUM and Bayesian changepoint code that runs in production. Nothing here is a screenshot.
The comparison that matters
Against the rule most teams actually ship
The standard configuration is a percentage or sigma threshold against a trailing mean, evaluated per metric. Run it over the exact same 14 series and count what lands in the channel.
The false-alarm count is not a judgement call. The incident was injected at a known index, so every naive alert before that index is wrong by construction.
What the engine found
Detection run
| Metric | Trend | Baseline | Now | Change | Confidence | Method |
|---|---|---|---|---|---|---|
p95 latency vendor=payments | 385ms | 777ms | +102% | 99.9% | CUSUM | |
Null rate, settlement_id vendor=payments | 0.62% | 14.7% | +2285% | 99.9% | CUSUM | |
4xx rate, code 402.7 vendor=payments | 1.39% | 5.25% | +278% | 99.9% | CUSUM | |
Mean response size vendor=payments | 8414.17 | 5302.17 | −37.0% | 99.9% | CUSUM |
Show your work
p95 latency · vendor=payments
Baseline mean μ = 0.0020 and σ = 0.0627, both computed from the first two thirds of the day-over-day percentage changes. The slack k = 0.0313 is half a sigma, and the decision boundary h = 0.2506 is four. The accumulator runs on percentage changes rather than raw levels so a healthy growing series cannot drift across the boundary on its own.
alert if |Δ| > 20% vs 7-day mean fired 5 times across this one metric. The statistical pipeline sent one message, on the day the regime actually changed.
What lands in Slack
One message, with the work already done
- 1.Pull ten flagged responses and diff them field by field against ten from Aug 5.
- 2.Make settlement_id a required field in your parser so the null path stops silently writing empty rows.
- 3.Send the vendor the changepoint date, the subcode, and the payload diff. That is a support ticket they cannot close as "no known issues".
The written cause is generated only after the statistics confirm the change. The model never decides whether something is an anomaly — it explains one that has already been established. Getting that order backwards is how these products hallucinate.