AT-1 Observe

The anomaly signal is free

Score every event by its conditional description length against a dictionary of normal traffic: normal events extend the dictionary cheaply, a novel log template or an out-of-distribution value costs many extra bits. It’s a label-free anomaly detector for logs, metrics and netflow — no rules, no signatures, no training — and the signal is free because you were compressing anyway.

Get the CLI Sensor version →

no labels: no rules, signatures, or training, pure compression surprise
AUC ≥ 0.90: normal vs anomaly separation on the reference battery
≥ 0.75 recall: at a threshold calibrated for ≤ 2.5% false positives
exit 2: flags stream anomalies for CI / alerting out of the box

Two commands

Learn a model of normal from a sample of your stream, then scan live traffic. The baseline is a small local file holding only your own normal-traffic bytes.

at1 observe baseline normal.log -o normal.at1obs
at1 observe scan   live.log --baseline normal.at1obs
#   scanned 42 events, 2 anomaly(ies) (threshold 0.50 bits/byte)
#   [1.400]  ERROR segfault at 0xdeadbeef in mod xyzzy
#   [1.083]  INFO auth user=ZZQ#@!K action=login latency=987654ms
# exit code 2 -> drop it straight into a CI step or a cron alert

What it catches

Novel error templates, out-of-distribution field values, injected/garbled records, format drift, anything that doesn’t compress like normal.

Multi-scale

Scores the whole line andeach token, so a single anomalous field isn’t diluted across an otherwise-normal event.

Honest boundary

Static dictionary (no concept-drift tracking yet); frequency/burst anomalies need a rate channel this doesn’t cover. It finds content surprise, not rate surprise.

Billed on events scanned, first 5M events/month free. See pricing. The same idea on sensor signals is Predictive Diagnostics.

A score nobody calibrated is a number, not a signal

Any tool can rank log lines by how unusual they look. The hard part is knowing whether the ranking means anything, because a scoring function applied to pure noise still produces a confident top ten, and that top ten looks exactly like a finding.

So every probe here is run twice: once on your data and once on a shuffled version of your data where any real structure has been destroyed. What you see is the gap between the two. If a signal does not beat its own shuffled null, it is reported as nothing found rather than dressed up as a weak positive, and a run that finds nothing is a successful run.

Why it comes free with the compression

A compressor earns its ratio by predicting what comes next. Where it predicts well the data is ordinary; where it is surprised, something changed. That surprise is a by-product you have already paid for by storing the data at all, which is why this does not need a separate pipeline, a labelled training set, or a model of what your normal looks like.

What it will not tell you

It finds rows that are unlike their neighbours. It does not know which of those matter, and it cannot tell a genuine incident from a deployment that legitimately changed the shape of your logs. It is an instrument that points, not a system that decides, and treating it as the second thing is how teams end up ignoring it.