This alert uses a dynamic predictive model to alert you when traffic anomalies are above or below the predictive model. The alert identifies both daily and weekly patterns in your CP code's traffic and uses them to make predictions that take into account normal cycles of the traffic over the course of a day or week. It can be set for only one CP code.

Available for

Media Delivery: Adaptive Media Delivery, Download Delivery, HTTP Content Delivery, HTTP Downloads, Media Services Live (HLS/HDS/DASH Ingest), Media Services Live (Smooth Ingest Enablement, Media Services Live (Stream Packaging), Media Services On Demand (Smooth Streaming Enablement), Media Services On Demand (Stream Packaging), NetStorage, Object Delivery, Performance Analytics Site Analyzer, Performance Analytics Stream Analyzer, Progressive Media, RTMP Streaming, RTMP/WMS/Quicktime Live Streaming, RTMP/WMS/Quicktime On Demand Streaming
Security: Site Defender
Web Performance: EdgeComputing, IP Application Accelerator, Session Accelerator, Site Accelerator, Site Accelerator Fast File Upload, Site Accelerator SLA Management, Site Accelerator Third Party Optimization, Site Delivery, Terra Alta Enterprise Accelerator, Terra Alta Enterprise Accelerator Composite Application Acceleration, Terra Alta Enterprise Accelerator Fast File Upload, Terra Alta Enterprise Accelerator SLA Management, Third Party Optimization, Web Application Accelerator, Web Application Accelerator Fast File Upload, Web Application Accelerator SLA Management

Configuration

Here are the terms you need to know to configure the adaptive alert:

Anomaly — happens when the traffic exceeds the upper or lower alert’s threshold.
Deviation — a configuration parameter that scales the predicted deviation calculated by the model. It acts as a multiplier for the model’s deviation, and the resulting value is used to draw the anomaly detection band on the chart. Increasing this parameter widens the band (making alerts less frequent), while decreasing it narrows the band (making alerts more sensitive). If set to 1, then if the traffic goes above or below the threshold just for one moment, it becomes an anomaly. If set to 2 or more, the traffic has to stay out of thresholds for a little longer to be considered an anomaly.
Polling cycle — 5 minute period.
Forgiving model — the alert is triggered less frequently, but some short anomalies aren’t detected.
Sensitive model — the alert is triggered more frequently, but it may be false positive.

Example

Configuration:
Alert me when 4 anomalies
Over 3 deviations
happen in 5 polling cycles

Meaning:
Adaptive alarm will be triggered when 4 anomalies, each containing 3 consecutive deviations, occur within 25 minutes (5 x 5 minutes).

Alert firing

A firing is a moment when an alert is considered triggered because the configured conditions have been met. The firing date represents the point in time when the threshold was first exceeded. For example, when the number of detected anomalies crossed the configured limit.

📘
The alert firing date can be in the past
When you create a new adaptive alert, historical data (up to the last six months) is analyzed. If the anomaly count exceeded the threshold in the past, the alert is triggered retroactively and the firing date reflects that past moment. If the anomaly count later dropped below the threshold, you don't get an alert notification, even if it was temporarily triggered in the past. If the anomaly count is still above the threshold, you get a notification about the alert.

Notification time

New Alert - Up to five minutes since the detection of the condition.
Alert Cleared - The condition is cleared for 15 to 20 minutes.

Suppress a fired alert

Atypical traffic rates that occur during some events (for example, a sale or a major holiday) cause the firing of the Adaptive alert. If you don't want to be alerted about such traffic, you can suppress the alert.

Troubleshooting

Follow the instructions from the Troubleshooting section on the alert's page.