Anomalies that explain themselves

Every monitoring tool can draw a red dot on a chart. The hard part starts after the dot: is this real, what caused it, and who should care? Most anomaly detection stops exactly where the work begins.

Vectry’s diagnostics layer is built on a different premise: an anomaly is not a number, it’s a story with a broken chapter.

Detected where it happens

Anomalies are recorded at the level where the deviation lives:

• event — a single malformed or out-of-place action
• trace — a step missing or out of order inside one entity’s flow
• causal_thread — a cross-system storyline that ended in the wrong outcome

The level + reference_id pair means every anomaly points at a concrete object you can open — not at a time window you have to excavate.

Expected vs. actual, side by side

Each anomaly stores the two patterns that disagree:

anomaly_type: 'sequence_violation'
expected_pattern: [quote.created, quote.approved]
actual_pattern:   [quote.created, quote.rejected]
deviation_score:  0.87

That structure does two jobs at once. The deviation_score gives triage an ordering — what to look at first. The pattern pair gives the reviewer an instant diagnosis surface: you see the break before you’ve read a single log line.

The link that changes the workflow

The field that matters most is the quietest one: event_explanation_id. An anomaly can reference the EventExplanation that reconstructs its causal chain — the caused_by sequence plus a narrative a human can read:

“The quote was rejected because the item was previously marked as expired by the system.”

With that link, anomaly triage stops being archaeology. The reviewer opens the anomaly, reads the expected/actual break, follows the explanation, and decides — often in minutes, with the evidence already assembled.

Feeding the loop

Because anomalies are first-class records — with status, actor metadata and tenant scope like everything else in Vectry — they can drive workflows: route a deviation_score > 0.8 anomaly to a human gate, auto-archive known benign patterns, or feed resolved cases back into detection thresholds.

Detection is a commodity. Explanation is the product.