Skip to main content


This section summarizes the mathematical outputs across all related methods of TIM Anomaly Detection with a kpi-driven approach.

CSV result (table)

There are two differently structured result tables; the one that is returned is based on the type of anomaly detection job.

build-model, rebuild-model, detect and what-if jobs

The first table below gives an overview of the output to expect of the tabular response (csv output) for anomaly detection jobs of type build-model, rebuild-model, detect and what-if:

timestampmodel_indexkpinormal_behavioranomaly_codeanomalyindicator"name of Detection Perspective"


The timestamp column represents the timestamp that corresponds to the given row of outputs.

Model index

The model_index column represents the index of the model that was used for the normal behavior evaluation of the KPI. The number of possible model indices depends on the configuration of the daily cycle parameter.


The kpi column shows the actual value of the selected KPI column for anomaly detection.

Normal behavior

Each row of the normal-behavior column contains a real number returned from the normal behavior model evaluation for a given data point. This number describes how the KPI is expected to behave under the circumstances given by the influencers.

Anomaly code

The anomaly_code column contains integer values from 0 to 3 indicating whether there is an anomaly in the KPI for a given timestamp. The returned value is evaluated based on all anomaly indicators (corresponding to the determined detection perspectives).

In case the anomaly indicators for all detection perspectives were calculated, the anomaly code is 1 in case at least one anomaly indicator is above 1, and 0 otherwise. In case the anomaly indicator for at least one detection perspective was not calculated, the anomaly code is 3 in case at least one of anomaly indicator is above 1, and 2 otherwise.

Anomaly indicators

For each of the included detection perspectives, a column is included for the corresponding anomaly indicator. These columns contain numbers from the interval (0, infinity) that specify the extent to which a given data point in time is anomalous. Data points with an anomaly indicator higher than 1 are considered anomalous. See the anomaly indicator section to learn more.

RCA jobs

The table presented below provides an overview of the expected output in tabular form (CSV output) for anomaly detection jobs of type RCA:


Root cause analysis (RCA)

The root cause analysis (RCA) result provides additional information on the contributions of terms and predictors within the scope of the normal behavior model. The sum of contributions across terms is equal to the sum across predictors, although it represents a different perspective on examining these contributions. By considering both the term and predictor contributions, a more comprehensive understanding of the factors influencing the normal behavior estimation can be obtained during the root cause analysis process. See the root cause analysis section to learn more.

Model result

A model result consists of three parts: settings, normalBehaviorModel and anomalousBehaviorModel. The table below shows the availability of the model result in the anomaly detection methods:

Configuration fieldbuild-modelrebuild-modeldetectrca

available in a given method
not available in a given method

Anomaly detection jobs of type build-model and rebuild-model produce a model, while anomaly detection jobs of type detect and rca make use of the model of their parent job.


One of the parameters contained in the model is the sensitivity parameter that was used to build the model. If a concrete input sensitivity parameter is specified, then the output sensitivity will represent this same value. If, however, only the maximum sensitivity and/or minimum sensitivity parameters are specified, TIM determines the sensitivity automatically and the result of this calculation is returned. The returned sensitivity can be found in the anomalous behavior part of the model, under detectedSensitivity, as shown below. It is always linked to a specific detection perspective.

"model": {
"anomalousBehaviorModel": {
"submodels": [
"perspective": "Residual",
"detectedSensitivity": 0.35

Error measures result

A performance metrics result consists of two parts: AUC and confusionMatrix. The table below shows the availability of this result based on the type of job:

Configuration fieldbuild-modelrebuild-modeldetectrca

available in a given method, but only if an anomaly label is defined in the relevant job
not available in a given method

Anomaly detection jobs of type build-model, rebuild-model and detect can produce error measures, but only in case an anomaly label is available in the data and was defined in the registration body of the job (build-model) or a parent job of the job (rebuild-model and detect). An RCA job type does not serve to measure the performance.

Example of the response:

"AUC": 0.9948358700639194,
"confusionMatrix": {
"truePositive": 30,
"trueNegative": 30502,
"falsePositive": 12,
"falseNegative": 200

If you want to learn more about these performance metrics, see the error measures section.