Anomaly Detection Brief

A complete anomaly detection brief with method recommendations, alert thresholds, and a triage runbook for on-call engineers.

Best For

•A data engineer setting up automated alerts for API error rate spikes before customers start reporting outages
•A finance analyst defining what counts as a genuine revenue drop versus normal day-of-week seasonality
•An on-call engineering lead writing a 5-step triage runbook so anomaly alerts don't just get dismissed as noise

Prompt Template

Write an anomaly detection brief for monitoring [METRIC_OR_SYSTEM, e.g., daily revenue / API error rate / user sign-ups] at [COMPANY_NAME]. The goal is to automatically flag when something is wrong so the team can investigate before customers are impacted. The brief must cover: (1) Metric definition, exact calculation of the metric being monitored and its data source, (2) Baseline behavior, describe the expected patterns: typical range [EXPECTED_RANGE], known seasonality (day-of-week, monthly cycles, holidays), and trend direction, (3) Anomaly types to detect, for each of the following anomaly types: spike, drop, gradual drift, and missing data, define what constitutes an anomaly (e.g., "a drop of more than 20% versus the same day last week"), (4) Detection method, recommend a specific statistical method (e.g., Z-score, IQR, EWMA, Prophet) appropriate for this metric's characteristics and explain why, (5) Alerting logic, alert threshold, cooldown period to prevent alert fatigue, and who gets notified via [NOTIFICATION_CHANNEL], (6) Triage runbook, a 5-step investigation checklist for the on-call engineer when an anomaly fires. Context: [ADDITIONAL_CONTEXT].

Pro Tip

Set a cooldown period on the alerting logic explicitly, since the most common failure mode of anomaly detection systems isn't missed incidents but alert fatigue that causes real ones to get ignored.

Example Output

A sample of what this prompt produces once you fill in the placeholders.

Metric: daily sign-ups, expected range 800-1,100 with a known Monday dip. Anomaly type: drop defined as more than 25% below the same weekday last week. Method: EWMA, chosen because it adapts to gradual trend shifts better than a fixed Z-score threshold. Alert: fires once per 4-hour cooldown window, routed to the on-call Slack channel.