nano SIEM
Search Commands

anomaly

anomaly

Detect statistical outliers using z-score or MAD (Median Absolute Deviation) analysis.

Description

The anomaly command identifies events that are statistical outliers. It supports two detection methods:

  • Z-score (default): Uses mean and standard deviation
  • MAD: Uses median and Median Absolute Deviation, more robust to outliers in the data

Syntax

... | anomaly field=<field> [by <field>] [threshold=<number>] [method=zscore|mad]

Required Arguments

field Syntax: field=<field> Description: Numeric field to analyze for anomalies

Optional Arguments

by Syntax: by <field> or by=<field> Description: Calculate statistics separately for each value of this field

threshold Syntax: threshold=<number> Description: Number of standard deviations (or MAD equivalents) for outlier detection Default: 3

method Syntax: method=zscore|mad Description: Detection method to use Default: zscore

MethodDescription
zscoreZ-score using mean and standard deviation
madMedian Absolute Deviation, robust to outliers

Output Fields

Both methods produce anomaly_score — a normalized score where higher values = more anomalous. The score represents how many standard deviations (or MAD equivalents) the value is from the center. For example, a score of 3.2 means the value is 3.2 standard deviations from the mean/median.

Score RangeInterpretation
0 - 2Normal range
2 - 3Unusual (95-99.7% confidence)
3 - 4Highly anomalous (>99.7% confidence)
4+Extreme outlier

Z-score method (default)

FieldDescription
avg_valMean of the field values
stddev_valStandard deviation of the field values
anomaly_scoreNumber of standard deviations from the mean (higher = more anomalous)
is_anomaly1 if anomaly_score exceeds the threshold, 0 otherwise

MAD method

FieldDescription
median_valMedian of the field values
mad_valMedian Absolute Deviation
anomaly_scoreScaled deviation from median, comparable to z-score (higher = more anomalous)
is_anomaly1 if anomaly_score exceeds the threshold, 0 otherwise

Examples

Detect unusual data transfers

* | anomaly field=bytes_out threshold=3

Anomalous response times per endpoint

* | anomaly field=response_time by endpoint threshold=2.5

Using MAD for outlier-resistant detection

* | anomaly field=bytes_out method=mad threshold=3

MAD is useful when your data may already contain outliers that would skew the mean/stddev calculation.

Unusual login counts with MAD

* | bin span=1h
  | stats count() as login_count by time_bucket, user
  | anomaly field=login_count by user method=mad threshold=3

Network traffic anomalies

* | anomaly field=bytes by src_ip threshold=2

Detect performance degradation

* | anomaly field=response_time by service_name threshold=2
  | where is_anomaly=true

Unusual file sizes

action=file_created
| anomaly field=file_size by file_type threshold=3

Process CPU anomalies using MAD

* | anomaly field=cpu_usage by process_name method=mad threshold=2.5

Detect data exfiltration

* | bin span=5m
  | stats sum(bytes_out) as outbound by time_bucket, src_ip
  | anomaly field=outbound by src_ip threshold=3

Usage Notes

Z-score method: Calculates (value - mean) / stddev. Best for normally distributed data.

MAD method: Calculates deviation from median using Median Absolute Deviation. The scale factor 1.4826 makes MAD comparable to standard deviation for normal distributions. Better for data with existing outliers.

Threshold: Common values are 2 (95% confidence), 2.5 (98%), or 3 (99.7%).

Minimum data: Requires sufficient data points for meaningful statistics.

Grouping: by parameter calculates separate statistics per group.

Choosing a method:

  • Use zscore (default) for clean data that is approximately normally distributed
  • Use mad when data may contain outliers that shouldn't influence the threshold
  • eventstats - Calculate statistics for comparison
  • where - Filter anomalous events
  • eval - Custom anomaly calculations
On this page

On this page