[UX] Anomaly Detection Anywhere in OpenSearch Dashboards (WIP)

[xeniatup]

Overview

AD Anywhere is an integrated solution that allows users to quickly create, run and view anomaly results from a Visualization. As the source data and metrics are defined when visualization was created, adding and managing an anomaly detector can be simplified and made easily discoverable. Customer can focus on what is outside of the bounds of normal for a time series visualization.

User stories

1. User quickly creates an anomaly detector to see out of bounds events on a time series visualization on a dashboard. The detector details and model features are prefilled from the data source and metrics of the visualization.
2. User sees a summary of the anomaly occurrences on the visualization and decides if they want to dive deeper.
3. User selects and edits a detector to adjust the accuracy of the results and/or the amount of notifications generated on the dashboard.
4. If user edits a visualization, they can update anomaly detector associated with it in a simple manner.
5. User is notified on the dashboard and through other channels of the anomaly occurrence to be aware of the system status.

Flow structure

Create anomaly detector from visualization

1. “Quick actions” menu on a dashboard panel > Popover with defaults and prefilled values > Maximized panel for visualization with AD configured and ready to run
2. “Quick actions” menu on a dashboard panel > Extended (advanced) set of parameters in a flyout > Maximized visualization panel with AD configured

Get notified of anomaly occurrence on the dashboard

1. Notification feed on the dashboard > Select an alert/anomaly > Detailed notifications feed in flyout
2. Indication of an anomaly on the visualization > Maximized visualization panel with detailed anomaly information

Manage anomaly detectors

1. Select a detector on the dashboard > Quick edit in popover/Advanced edit in flyout > Restart the detector
2. Edit visualization > Prompted to review detector details and feature metrics > Review and edit > Restart the detector

Wireframes

Create AD

Notified

Manage detectors

Detailed design mockups

Quick create

Advanced create/Edit

Open questions

• How do you monitor or manage anomalies in your system?
• What are the most frustrating problems that you would want to detect in your system?
• What do you expect to see creating a detector?
• What other resources do you want to find anomalies out of?
• How would you expect to be notified of an anomaly while looking at a dashboard and not?