Build an AI Anomaly Detector

Build an AI anomaly detector with DSPy - define what normal looks like, score events for severity, route by risk level, and explain findings to human reviewers.

Step 1: Understand the detection task

Ask the user:

1. What events are you analyzing? (transactions, logins, API calls, server logs, user actions, etc.)
2. What does "normal" look like? (Do you have historical baselines? Average values? Known-good patterns?)
3. What counts as suspicious? (Frequency spikes, unusual amounts, geographic outliers, time-of-day mismatches, etc.)
4. What action should fire on detection? (Alert, block, escalate to human, log for review, etc.)
5. What false-positive tolerance do you have? (Low tolerance = only flag high-confidence anomalies; high tolerance = cast wide net)

The answers determine severity thresholds, routing logic, and how much baseline context to include.

When NOT to use AI anomaly detection