The anomaly signal is free
Score every event by its conditional description length against a dictionary of normal traffic: normal events extend the dictionary cheaply, a novel log template or an out-of-distribution value costs many extra bits. It’s a label-free anomaly detector for logs, metrics and netflow — no rules, no signatures, no training — and the signal is free because you were compressing anyway.
- no labels
- no rules, signatures, or training — pure compression surprise
- AUC ≥ 0.90
- normal vs anomaly separation on the reference battery
- ≥ 0.75 recall
- at a threshold calibrated for ≤ 2.5% false positives
- exit 2
- flags stream anomalies for CI / alerting out of the box
Two commands
Learn a model of normal from a sample of your stream, then scan live traffic. The baseline is a small local file holding only your own normal-traffic bytes.
at1 observe baseline normal.log -o normal.at1obs at1 observe scan live.log --baseline normal.at1obs # scanned 42 events, 2 anomaly(ies) (threshold 0.50 bits/byte) # [1.400] ERROR segfault at 0xdeadbeef in mod xyzzy # [1.083] INFO auth user=ZZQ#@!K action=login latency=987654ms # exit code 2 -> drop it straight into a CI step or a cron alert
What it catches
Novel error templates, out-of-distribution field values, injected/garbled records, format drift — anything that doesn’t compress like normal.
Multi-scale
Scores the whole line andeach token, so a single anomalous field isn’t diluted across an otherwise-normal event.
Honest boundary
Static dictionary (no concept-drift tracking yet); frequency/burst anomalies need a rate channel this doesn’t cover. It finds content surprise, not rate surprise.
Billed on events scanned — first 5M events/month free. See pricing. The same idea on sensor signals is Predictive Diagnostics.