deploy-anomaly-detection — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-anomaly-detection (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
az account showaz deployment group create -g $RG -f infra/main.bicep -p infra/parameters.jsonResources:
Metrics Source → Time Window → Anomaly Detection → Classification → Alerting
│ │ │ │ │
├─ App Insights ├─ 5-min ├─ Statistical ├─ Severity ├─ PagerDuty
├─ Prometheus ├─ 15-min ├─ ML-based ├─ Category ├─ Teams
└─ Custom metrics └─ 1-hour └─ LLM-augmented └─ Priority └─ Email| Method | Best For | Latency | Setup |
|---|---|---|---|
| Statistical (Z-score) | Simple threshold-based | <1s | Low |
| Azure Anomaly Detector | Multivariate time-series | 2-5s | Medium |
| Isolation Forest | High-dimensional data | 1-3s | Medium |
| LLM pattern recognition | Complex, context-dependent | 5-10s | High |
| Severity | Detection | Example | Action |
|---|---|---|---|
| Sev 0 (Critical) | >5σ deviation, multiple metrics | Service down | PagerDuty immediate |
| Sev 1 (High) | >3σ deviation, sustained 15min | Latency spike | PagerDuty + Teams |
| Sev 2 (Medium) | >2σ deviation, sustained 30min | Error rate increase | Teams notification |
| Sev 3 (Low) | >1.5σ deviation, informational | Minor trend change | Dashboard only |
# LLM-powered root cause analysis
async def analyze_root_cause(anomaly_context):
prompt = f"""Analyze this anomaly and suggest root causes:
Metric: {anomaly_context['metric']}
Current value: {anomaly_context['value']} (normal: {anomaly_context['baseline']})
Duration: {anomaly_context['duration']}
Correlated anomalies: {anomaly_context['correlated']}
Recent changes: {anomaly_context['recent_deployments']}
Provide: 1) Most likely root cause 2) Recommended actions 3) Blast radius"""
return await openai_client.chat.completions.create(model="gpt-4o", messages=[...])// Anomaly detection KQL
let baseline = toscalar(metrics | where timestamp between(ago(7d)..ago(1d)) | summarize avg(value));
let stddev = toscalar(metrics | where timestamp between(ago(7d)..ago(1d)) | summarize stdev(value));
metrics
| where timestamp > ago(1h)
| extend anomaly_score = abs(value - baseline) / stddev
| where anomaly_score > 3
| project timestamp, metric_name, value, baseline, anomaly_score| Issue | Cause | Fix |
|---|---|---|
| No anomalies detected | Threshold too high | Lower from 3σ to 2σ |
| Too many alerts (alert fatigue) | Threshold too low | Raise threshold, add suppression window |
| Delayed detection | Time window too long | Reduce from 1h to 15min |
| Root cause analysis wrong | Missing context | Add correlated metrics and recent deployments to prompt |
| Missing metrics | Source not connected | Verify diagnostic settings in source resources |
| Dashboard slow | KQL scanning too much data | Add time filters, summarize at higher grain |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.