DOCS-453 - Metrics Anomaly option

blog-service/2024-10-15-metrics-alerts.md

@@ -0,0 +1,31 @@
+---
+title: AI-Driven Alerts for Metrics Anomalies (Monitors)
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - metrics
+  - monitors
+  - alerts
+  - anomalies
+  - ai
+hide_table_of_contents: true  
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+We are excited to announce the general availability of AI-driven alerts for metrics anomalies. This release extends our AI-driven alerting capabilities, previously available for logs-based monitors, to metrics-based monitors, enabling you to respond to critical incidents more effectively.
+
+## Benefits
+
+- **Reduces alert fatigue**. AI-driven anomaly detection minimizes irrelevant alerts, allowing customers to focus on critical incidents.
+- **Faster incident resolution**. Automated playbooks enable customers to reduce the mean time to resolution by automating repetitive tasks and gathering key diagnostic information.
+
+## Key features
+
+- **Advanced anomaly detection**. A built-in machine learning model analyzes at least 30 days of historical data to establish baseline behavior, detect seasonality, and automatically tune detection parameters. This helps reduce noise from expected spikes while isolating critical issues.
+- **Customizable detection framework**. The "Cluster anomalies" detector allows users to specify custom conditions for incident detection, such as marking an anomaly when a defined number of data points within a time window exceed thresholds.
+- **Playbook integration**. Customers can automate incident resolution workflows by associating playbooks with metrics monitors. Playbooks streamline responses by gathering diagnostic data, notifying collaborators, and automating recovery tasks.
+
+
+<!-- learn more link -->

docs/metrics/metrics-anomalies-alerts.md

@@ -0,0 +1,74 @@
+---
+id: metrics-anomalies-alerts
+title: AI-Driven Alerts for Metrics Anomalies
+description: Learn about AI-Driven Alerts for metrics-based monitors, which includes advanced anomaly detection and automated incident resolution through playbooks.
+---
+
+<!-- Move entire doc to /monitors/alerts docs -->
+
+AI-driven alerts for metrics-based monitors use machine learning to analyze historical data, detect significant deviations, and filter out irrelevant alerts, reducing alert fatigue and allowing teams to focus on critical issues. These capabilities apply to both logs and metrics, providing a comprehensive monitoring solution.
+
+Integrated playbooks automate incident response by gathering diagnostics, notifying teams, triggering recovery actions, streamlining workflows, and improving response times. The customizable "Cluster anomalies" detector allows users to set specific triggers for spiky systems, further reducing false positives and enabling faster issue resolution.
+
+<details>
+<summary>What are AI-driven alerts?</summary>
+
+AI-driven alerts use machine learning to analyze historical data, establish baselines, and detect significant deviations in metrics signals. Seasonality detection reduces false positives, and integrated playbooks automate incident response, helping teams resolve issues faster.
+
+</details>
+
+## Key features
+
+### Advanced anomaly detection
+
+- **Machine learning models**. Use 30 days of historical data to establish baseline behavior and detect deviations.
+- **Seasonality detection**. Identify recurring patterns, minimizing false positives from periodic spikes.
+- **Auto-tuning**. Automatically adjust detection parameters to balance noise and relevance.
+- **Extensible detection framework**. Customizable rules, such as "Cluster anomalies," allow for advanced incident detection based on multiple data points exceeding thresholds within a defined time window.
+
+### Playbook integration
+
+Automate responses to anomalies, including diagnostics, team notifications, and recovery tasks like restarting services or scaling infrastructure by linking playbooks to metrics-based monitors.
+
+## Prerequisites
+
+To fully leverage AI-driven alerts for metrics monitors, you'll need:
+
+- **Automation Service**. Required for linking playbooks to metrics-based monitors.
+- **Metrics data**. Metrics data must be sent to Sumo Logic for anomaly detection.
+- **Metrics aggregation**. Queries that return multiple time series should be aggregated (e.g., using `sum` or `avg` operators) before applying anomaly detection.
+
+
+
+## Create a metrics anomaly monitor
+
+1. Go to **Alerts** > **Monitors**, then click **Add** > **New Monitor**.
+1. Under **Trigger Conditions**:
+   * For **Monitor Type**, select **Metrics**.
+   * For **Detection Method**, select **Anomaly**.
+1. Enter your alert conditions, notification settings by going to [Create a Monitor](docs/alerts/monitors/create-monitor.md) and following steps 2 to the end.
+
+## Examples
+
+* **Cluster anomalies detection**. A user configures alerts for anomalies when 5 out of 10 data points in a 10-minute window exceed the baseline, allowing for precision in spiky environments.
+* **Automating resolution with playbooks**. A playbook responds to CPU usage anomalies by gathering logs, notifying teams, and restarting affected servers.
+
+## Limitations
+
+Anomaly detection applies to one time series at a time. Multi-time series queries must be aggregated before detection.
+
+## Getting started with playbooks
+
+1. Visit **Automation Service App Central**.
+2. Browse over 500 pre-built playbooks.
+3. Clone and customize a playbook based on your requirements.
+
+By leveraging pre-built playbooks, you can quickly automate incident responses, reducing time to resolution.
+
+## More information
+
+* [Automation Service](/docs/platform-services/automation-service)
+* [Automated Playbooks](/docs/alerts/monitors/use-playbooks-with-monitors/)
+* [Create a Monitor](/docs/alerts/monitors/create-monitor)
+* [App Central](/docs/platform-services/automation-service/app-central)
+* [Metrics Operators](/docs/metrics/metrics-operators)