Page Comparison

...

Anomaly => Very different value (much bigger/smaller value) than the neighbor's values

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Score Anomalies operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the name of the table containing the data to run this operator on.
4. In the Column drop-down, enter or select the name of the column on which the anomaly scores will be calculated.
5. Optional. In the Grouping Fields drop-down, enter or select the name of the columns to group events by.
6. Click Run to view the result.
7. Click Save to add the operator to the playbook.
8. Click Cancel to discard the operator form.

Usage Details

LQL Command

scoreAnomalies(table, scorefield)

...

Output
Input table with an additional field (lhub_score) that contains the score values. Higher value means a more anomalous event.

Example

Input
table = github_logs

...