Behavioral analysis
Configure metrics to aggregate events into time series and monitors to observe those series and open alerts when the behavior falls outside the expected range. The two layers work together: every monitor observes a metric.
Analyses are transactional: they score one event at a time, the moment it arrives, for rules to use. Metrics and monitors are behavioral: they observe aggregate behavior over time.
How they relate
The starting point is the events sent by the operation. Over those events, a metric aggregates the data over time: it counts occurrences, sums values or calculates rates. The metric is the observation instrument.
Once the metric is defined, a monitor follows it automatically. The platform runs the monitor at regular intervals and opens an alert when the detection rules are satisfied. The rules are a manual condition over a threshold, anomaly detection through machine learning, or both together.
Dashboards bring the metrics that matter most to the operation together in configurable panels, on a single screen.
type: "transaction" agg: count dim: "status" filter: "BRL"
metric: "transaction" interval: 5min rule: anomaly alert: ↑ spike
When to use each
A metric answers questions about the past and the present, such as the number of transactions per hour or the average approved amount. The metric is the tool for observation and analysis.
A monitor gives automatic notice of relevant changes: a sharp drop in volume, an abnormal increase in declines, a value that exceeded a critical threshold. The monitor is the continuous surveillance layer.