Reference · built on requestOperator by FibricReporting & analysis

Anomaly Notice

A sudden move in a tracked series flagged, candidate causes gathered from adjacent event streams, a notice proposed to the owner.

Request accessPricing ↗

About

A series that has held its shape for weeks jumps. This operator notices the jump and asks the systems next door what happened. It reads the series you track from your warehouse at the interval you set. For the same window it reads event volume from your streams: messages per topic in Kafka, events per source and detail-type on an EventBridge bus, deliveries to a webhook endpoint. A stream that changed shape at the same time is listed as a candidate cause, with the evidence.

It writes a notice to the owner of the series: what moved, by how much against the recent range, the candidates, and what it could not check. The owner approves the notice or extends the watch.

This is a reference listing. It documents what Fibric would read from Anomaly Notice and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Values for each tracked series at a fixed interval from tables or views you name in Snowflake or PostgreSQL
  • Event counts per topic and partition in Apache Kafka over the same window, read from the topics you list
  • Event counts by source and detail-type on an Amazon EventBridge event bus, from the rules you attach to it
  • Deliveries and failures at a webhook endpoint you register, counted per minute
  • Prior notices for the same series and their outcomes, so a repeat is labeled as one
  • The owner and quiet hours registered for each series

Proposed actions

  • Target capability: propose a notice to the series owner in Slack or Microsoft Teams with the move, the range it left, and the candidate causes
  • Target capability: propose a watch extension that keeps sampling the series at a shorter interval for a period you set
  • Target capability: propose a known-cause annotation when the owner names the cause, so a repeat is matched to it
  • Target capability: propose a follow-up task to the team that owns the stream named as the most likely cause

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Trace a spike to a topic

    Checkout latency in Snowflake jumps overnight. Message counts on one Kafka topic rose in the same window. The notice names the topic and proposes a task for its owning team.

    With Snowflake, Apache Kafka, Slack

  • Match a drop to missing events

    An hourly order series in PostgreSQL falls to zero. The EventBridge rule for order events shows no matches in that hour. The notice says the feed stopped, and the orders may not have.

    With PostgreSQL, Amazon EventBridge, Microsoft Teams

  • Watch a webhook endpoint

    A registered webhook endpoint reports failed deliveries. If a tracked series depends on those events, the notice lists the failure count beside the move and proposes a watch extension.

    With Webhook Ingest, ClickHouse

  • Suppress the repeat

    The owner marks a Monday jump as the weekly batch. The next Monday, the same shape is matched to the annotation and reported as known, with no new notice.

    With Snowflake, Slack

Requirements

  • A warehouse connector with the series as a table or view: Snowflake, PostgreSQL, or ClickHouse
  • One or more event stream connectors: Apache Kafka, Amazon EventBridge, or a registered webhook endpoint
  • A messaging connector for the notice: Slack or Microsoft Teams
  • A registry of series with owner, interval, and the recent range it is compared against
Authentication
Read access on the warehouse tables that hold the series, consumer credentials on the streams you list, and a messaging app scope to post the notice.

Limits

  • It reads counts and timestamps from streams. It does not read message bodies unless you grant that and name the fields.
  • Kafka retains events per topic for the period you configure. A window older than that retention cannot be re-counted.
  • A candidate cause is a stream that moved in the same window. Coincidence is possible; the owner decides.
  • Microsoft Graph sends a channel message with a delegated permission, so the notice posts as the person who approves it.

Access and pricing

Reference listing. Fibric builds the operator under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Anomaly Notice ↗

Questions and answers

What does the series owner approve?
The notice itself, or a watch extension instead. The proposal shows the series, the value, the range it left, each candidate stream with its counts, and the checks that could not run. The owner can name a cause, which becomes an annotation.
What record is left after a notice?
One entry per flagged move: the samples, the candidates and their evidence, the notice text, who approved it, and the message id returned by the channel. Dismissals are kept with the reason.
Will it page anyone or change a stream?
No. It posts a notice only after approval and only to the channel you named. It never creates an incident, changes a rule, moves a consumer offset, or alters retention on any stream.
Ask about Anomaly Notice

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This operator is developed, published, and supported by Fibric. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy