The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is:
AVG(Firewall Session)represents the current firewall session rate.
STAT_AVG(AVG(Firewall Session);112)represents the historical average over a 112-time unit window.
STAT_STDDEV(AVG(Firewall Session);112)represents the historical standard deviation over the same period.
AZ-score ≥ 3indicates that the current firewall session rate issignificantly higherthan the historical average (3 standard deviations above the mean), signaling ananomaly.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit