Anomaly Best Practices¶

Triaging anomalies well

Guidelines for keeping the anomaly list short, trusted, and acted on. They apply whether your team triages a handful of anomalies a week or hundreds a day.

Set Up Before the First Scan¶

• Link an enrichment datastore. Without one, anomalies have no source records, and the team has to query the source to see what failed. See Source Records.
• Set a default assignee on important checks. Each new anomaly then starts with an owner, and nobody has to route it by hand. See Anomaly Assignees.
• Set the importance of the checks that matter. A check's tags set its Importance, and Importance raises or lowers the Impact of the anomalies it produces, so a high-importance check puts its anomalies at the top of the list. Tags on the anomaly itself do not change its Impact. See Check Importance.
• Turn on duplicate handling for recurring loads. For tables that are reloaded on a schedule, turn on Archive Duplicate Anomalies and Reactivate Recurring Anomalies, so each issue appears once. See Fingerprints.

Triage in Order¶

• Work from the top of the list. Anomaly lists are sorted by Impact, so the anomalies that matter most come first.
• Read the evidence before deciding. Look at the failed check messages and the source records. An anomaly is evidence of a potential issue, not proof that the data is wrong.
• Acknowledge what you are working on. Acknowledging keeps the anomaly open but shows the team it has been seen, so two people do not pick up the same one.
• Use Shape anomalies as a signal of scale. A rolled-up Shape anomaly means a check failed many rows at once. Look for one cause, such as a bad load, before looking at rows one by one.

Close with the Right Resolution¶

• Choose the resolution on purpose. Resolved and Invalid also tune AI Managed checks: Resolved makes Qualytics trust a check more, Invalid less. Archiving a real issue as Invalid, or a false alarm as Resolved, teaches the check the wrong lesson. See How Triage Tunes AI Managed Checks.
• Use Duplicate only for a real duplicate. An anomaly archived as Duplicate is never reopened by a later Scan. When you cannot point to the original, prefer Discarded.
• Always leave a comment. A comment on the archive says why it was closed, so the next person who sees the same issue does not start over.
• Fix the rule, not just the anomaly. When the same false alarm keeps coming back, change the check: lower its coverage for an accepted exception, or adjust its limit. Archiving the same anomaly every week hides the problem without solving it.

Keep the Team in the Loop¶

• Link a ticket when the fix belongs to another team. The ticket carries the anomaly's details to them, and with Anomaly status sync on, closing the ticket can close the anomaly. See Anomaly Tickets.
• Use Flows for the alerts that matter. A Flow on Anomaly Detected with an Anomaly Impact filter, such as is at least High, reaches people only for the anomalies worth interrupting them for. See Flow Triggers.
• Mention people who can act. A mention notifies anyone, but only users with access to the datastore can open the anomaly.

See Also¶