Build an AI Anomaly Detector

Build an AI anomaly detector with DSPy - define what normal looks like, score events for severity, route by risk level, and explain findings to human reviewers.

Step 1: Understand the detection task

Ask the user:

1. What events are you analyzing? (transactions, logins, API calls, server logs, user actions, etc.)
2. What does "normal" look like? (Do you have historical baselines? Average values? Known-good patterns?)
3. What counts as suspicious? (Frequency spikes, unusual amounts, geographic outliers, time-of-day mismatches, etc.)
4. What action should fire on detection? (Alert, block, escalate to human, log for review, etc.)
5. What false-positive tolerance do you have? (Low tolerance = only flag high-confidence anomalies; high tolerance = cast wide net)

The answers determine severity thresholds, routing logic, and how much baseline context to include.

When NOT to use AI anomaly detection

• High-volume numeric time series — millions of events/second with simple numeric signals (CPU, latency, request rate). Use statistical methods instead - z-score, EWMA, isolation forest, or Prometheus alerting rules.
• Simple threshold rules — "flag any transaction over $10,000" does not need an LM. Write a rule.