Review findings

You will learn how to read a finding, check its evidence, and decide what to do with it: dismiss it, mute what you already know about, or keep watching a pattern.

Findings are what anomaly detection raises when a stream stops looking like its own history.

Before you start

Select a stream in the sidebar.
Turn on anomaly detection for it.
Reading findings needs the Query stream role. Dismissing, reopening, muting, and watching need Settings or higher.

1. Scan the list

Open Findings. Findings are grouped by day — Today, Yesterday, then by date — newest first. Within a day, findings that fired together in the same scan (or joined an open incident by shared service or pattern) appear as one expandable incident row listing the affected services; expand it to open each finding.

Status tabs: Open (the default), Resolved, Dismissed, All, each with a count.
Kinds: New pattern, Spike, Drop, Error rate, Volume, Metric. Select several to combine them.
Severity: Any severity, Critical, Warning, Info.
Service: one service, or All services.
Last detected within: 24h, 7d (the default), or 30d.

Each row shows the severity, the kind, the headline, the observed value against the usual one (for example 412 vs usual 38), the service, when it was first and last seen, how many times it was detected, and a 24-hour sparkline. A Learning tag means it was raised during the learning period and won't alert; a ringing bell means a Findings monitor has alerted on it.

Filters are kept in the page address, so you can share a filtered list.

2. Open a finding

Click the headline. The detail page explains the finding in four parts.

Why this was flagged lists the reasons from the scan and the numbers behind them:

Value	Meaning
Observed	The count, share, or metric value in the detection window. New patterns show Events in the window.
Usual	The median of the same time over earlier periods. New patterns show Never seen.
Periods compared	How many earlier periods made up the baseline.
Deviation	How unusual the window is, against the threshold for the stream's sensitivity.

What changed charts the last 24 hours or 7 days with the usual value, the normal range, and the detection window shaded. Error rate findings chart the error share; metric findings chart the metric's own series.

Contributing events lists the events in the detection window, with the stream's redaction applied. Open one to see the full stored event.

The side of the page shows the Pattern (with Open in Patterns) or the Metric (with Open in Metrics), any Alerts raised for the finding, and the Timeline of detections, escalations, dismissals, and reopens.

To dig further, click Open in Query to see the pattern's events, or Open metric for a metric finding.

3. Decide

If the finding is	Do this
Real and you are handling it	Leave it open. It resolves by itself once it is no longer seen for two scans.
Expected, noise, or already fixed	Dismiss… it with a reason.
Something that will keep happening and you don't care about	Mute… its pattern, service, or kind.
Worth a standing alert on this one pattern	Watch this pattern.
Worth alerts for anything like it	Alert on findings like this — see Alert on findings.

Dismiss a finding

Click Dismiss….
Under Why?, pick Expected (a deploy, test, or known event caused it), Noise (not worth looking at), Fixed (the cause has been dealt with), or Other and write a short Note.
Click Dismiss.

A dismissed finding never alerts. If the same thing happens again later, Cordo raises a new finding. To undo, open the Dismissed tab, open the finding, and click Reopen.

Mute what you already know

A mute stops new findings for a subject and dismisses the matching open ones.

Click Mute… on the finding (or Mute for in a row's menu).
The menu names what it covers — the finding's kind for its pattern, else for its service, else for the whole stream — for example Mute spike findings for pattern #7 for.
Choose 24 hours, 7 days, or Always.

From Patterns, open a pattern and use Mute in findings to mute every kind of finding for that pattern. Muted patterns show a crossed-out bell on the Patterns page.

Metric findings mute for the whole stream. To quiet one noisy metric instead, clear Anomaly scan on that metric (see Turn on anomaly detection).

Unmute: edit the stream on Streams, open Anomaly detection, find the mute under Muted, and click Unmute.

Watch a pattern

Watch this pattern turns the finding's pattern into a recorded metric and a monitor, so you are alerted on it even without anomaly detection. See Turn a pattern into a monitor.

Troubleshooting

Symptom	What to check
No findings at all	Detection is on and the scan status shows a recent scan; Nothing unusual in the last 7 days means scans are running and found nothing.
A finding says Learning	The stream is in its first week of pattern history. Findings appear but never alert.
A finding resolved on its own	It was not seen in the next two scans, a new pattern became more than a day old, or the stream hit 500 open findings and the least severe closed first.
Too many findings from one service	Add it to Ignore services in the stream's anomaly detection settings to leave its events out of the scan, or mute its noisy patterns.
A spike you expected is missing	The pattern needs Minimum events in the window and at least double its usual count; quiet patterns and lower sensitivity filter more out.
Reopen fails	Another open finding already covers the same subject. Open that one instead.
No events under Contributing events	For a drop, the pattern went quiet in the window — that is the finding.