Technically, to build a model, TIM only requires data and defined Target/KPI. Having a reasonable model is crucial for finding the right anomalies. The most important things that affect the quality of the model may be divided into two parts:
Math/Machine learning - The goal is to automatize the anomaly detection process on your data. This is related to things as feature expansion, feature reduction, selection of normal behavior and detection model and its parameters and creation of anomaly indicator. TIM does this part of the work in an automatic way.
Domain-specifics - The goal is to set up a scenario in the most reasonable way for your domain/problem. This is related to data - defining KPI, choosing the right influencers and if needed adjusting the update times of your data, sensitivity and perspective of how you look on anomalies. Even though TIM has an automatic/default configuration mode, a domain expert is the right person to adjust it resulting in less false positives or false negatives.
First, you put your data in a required format, determine a target/KPI on which you want to detect anomalies and, if available, include influencers/features that affect your KPI. Selection of the influencers and period of data for model building can significantly affect the results. You build your model on historical data and then, based on this model you are evaluating new measurements as they flow into your database. Technically, if you have data, you can automatically create a model.
However, to have a model which meets your domain specifics you have also to define your routine (influencers updates and availabilities), as the understanding of what your data looks like in the moment of detection is also important. In default mode, TIM expects aligned data which is often the case in anomaly detection. The detection features - perspectives of how you look on anomalies is also the way how the user can adapt anomaly detection to his preferences. Finally, there is a customizable sensitivity parameter which lets you to fine-tune sensitivity to potential anomalies based on your business risk profile, whereby it is also possible to let TIM find a reasonable sensitivity in an automatic way.
Model building task returns not only a model but also results - anomaly indicator values on the model building period. Analysis of the result helps you to decide if the model was configured appropriately.
In case you are not satisfied with the results and want to tweak TIMs performance, you can play with the configuration of both domain-specifics mentioned above and mathematical settings manually. If you are satisfied with the model, you can use it for detection as often as a new data point comes into your database.
To sum it up, data are a must for creating a reasonable model. To have the best possible model you have to use your domain knowledge to define the model building scenario. A built model can be used for detection as often as required. We will go into detail for all of the mentioned topics.