Anomaly detection and alerts

SanSignal records detected anomalies when enabled definitions match their configured conditions. Definitions can also request email notifications. Configure conditions from your project’s monitoring requirements and test them against the intended variables.

Create a definition

1. Open Anomalies and create a detection definition.
2. Enter a name and select Low, Medium, High, or Critical severity.
3. Choose AND or OR for the condition set.
4. Add conditions and manually select the target instrument variables.
5. Run the condition test and review its results.
6. Optionally add an email action, then enable and save the definition.

AND requires every evaluable condition to pass; OR requires at least one evaluable condition to pass. Disabled conditions remain saved but do not participate. A disabled definition can preserve incomplete configuration while you prepare it.

Comparison conditions

A comparison uses a decimal variable, an operator (=, >=, <=, >, or <), and a numeric value. You can require consecutive readings and optionally set a maximum duration for that sequence.

For example, a definition might compare a selected displacement variable against a project-defined review threshold and require several consecutive readings. This is a configuration pattern, not a recommended engineering threshold.

If targets have different units, the same comparison value is applied without conversion. Use separate conditions or normalize the variables before comparing them.

Missing-signal conditions

Choose the target variables and a missing-signal duration in minutes.

Missing-signal evaluation is triggered by a new, non-skipped data point arriving in the project. It is not an independent timer. If the entire project stops receiving readings, this condition does not independently wake up to report the silence. Account for this behavior when designing operational checks for total source outages.

Test before enabling

Use the condition test to check target selection and evaluation results. Review unavailable targets, value types, units, and durations. The test helps validate the condition configuration; it does not prove that an email will reach a recipient.

Targets and notification resources can later become unavailable, for example after archiving. Inspect those warnings when editing a definition.

Review detected anomalies

Open Detected Anomalies and filter by instrument, variable, severity, definition, action result, or date range. An occurrence retains the triggering data point, captured definition information, and condition evidence. Action results can continue updating asynchronously after the occurrence is recorded.

Email actions have a trigger cooldown to control repeat notification attempts. The occurrence cooldown uses the lowest action trigger cooldown when actions are configured. See Notifications for recipients, templates, and delivery results.