Anomaly Detection Skill: Making Data Anomalies Nowhere to Hide

Have you ever had this experience:

• •Open your data dashboard daily, scan each metric, feeling something is "off" but can't pinpoint what
• •Sales dropped 20%, and you only discover it three days later
• •Your boss asks "Why did conversion rate drop last week?" and you stumble, because you didn't even notice

The common thread in these scenarios: The problem isn't in the data—it's in the timeliness of discovery.

The biggest gap between a senior data analyst and a novice is often not analytical ability itself, but the speed and accuracy of spotting problems. An experienced analyst looks at a trend chart and knows "this point is off" at a glance, while a beginner might stare for half an hour without spotting the anomaly.

AskTable's Anomaly Detection Skill does one thing: Transforms this "spotting issues at a glance" capability into automated monitoring that everyone can use.

---

I. Essence of Anomaly Detection: Not Absolute Values, But Deviation

1.1 What Is "Anomaly"?

In data analysis, anomaly isn't "very large" or "very small" values—it's deviation from normal patterns.

Example:

An e-commerce platform's average daily sales is 1 million yuan.

Scenario A: Sales become 500,000 one day → Is this anomaly?
Scenario B: Double 11 sales become 5 million → Is this anomaly?
Scenario C: Continuous decline of 5% per day for a week → Is this anomaly?

The answers are all different:

• •Scenario A: If it's a workday suddenly dropping to 500,000, 50% deviation from normal—it's anomaly
• •Scenario B: Double 11 is本来就是促销日, 5 million within expected range—not anomaly
• •Scenario C: 5% daily decline seems small, but continuous seven days accumulates to 30%—it's a trending anomaly

So the core of anomaly detection isn't setting a fixed threshold (like "alert when below 800,000"), but understanding the normal fluctuation range of data, then identifying points deviating from this range.

1.2 Human Intuition vs Algorithm Judgment

Where does a senior analyst's "intuition" come from?

Essentially, their brain stores hundreds to thousands of "data pattern - business reason" mappings. When they see a curve, their brain automatically:

1. •Compares with historical trends from memory
2. •Identifies "this pattern is abnormal"
3. •Matches possible business reasons ("last time this pattern appeared was due to system failure")

But human brains have three limitations:

• •Can't remember too many details: You remember last month's general trend, but not daily specific values
• •Easily disrupted: Normal fluctuations for consecutive days make you relax vigilance, missing real anomalies
• •Can't work 7×24: You clock out, on weekends, on holidays—data keeps changing

The Anomaly Detection Skill does what algorithms simulate this pattern recognition capability while breaking through human brain limitations.

---

II. How AskTable Anomaly Detection Works

2.1 Three-Step Anomaly Detection Process

AskTable's anomaly detection follows a clear three-step process:

Step 1: Establish Baseline — Know What "Normal" Looks Like

Baseline isn't a straight line, but a dynamic normal range. AskTable calculates from historical data:

• •Moving average: 7-day/14-day/30-day averages, reflecting recent level
• •Quantile range: 25%-75% quantile (normal range), 5%-95% quantile (acceptable range)
• •Volatility: Data's standard deviation, judging fluctuation intensity
• •Seasonal patterns: Workday vs weekend, month-start vs month-end, peak vs off-peak

Example: A store's average daily sales over past 30 days is 50,000 yuan
- Workday average: 55,000, range 45,000-65,000
- Weekend average: 38,000, range 30,000-45,000
- Volatility: 12%

If sales drop to 35,000 one workday:
- Deviation from workday baseline: (55,000 - 35,000) / 55,000 = 36%
- Far exceeds normal fluctuation range (12%)
→ Determined as significant anomaly

Step 2: Identify Deviation — Judge "Anomaly" Degree

AskTable doesn't simply say "there's anomaly," but tells you:

Step 3: Recommend Drill-Down — Point to Root Cause

Discovering anomaly is just the first step—more important is knowing where to find the cause.

AskTable automatically recommends the most relevant drill-down dimensions based on anomaly characteristics:

Anomaly: Today's sales down 22%

Recommended drill-down dimensions:
1. By region → East China down 35%, other regions normal
2. By category → East China's 3C digital category down 50%
3. By time slot → Orders sharply dropped 10-12am

Initial judgment: East China 3C category anomalous in morning hours

This "auto-recommendation" capability comes from AskTable's automatic analysis of data characteristics—it calculates each dimension's contribution to anomaly, then sorts recommendations by contribution size.

2.2 Dynamic Thresholds: Not Rigid Rules, But Living Standards

The problem with many monitoring tools: thresholds are set too rigidly.

❌ Fixed threshold: "Alert when sales below 800,000"
Problem: 800,000 is normal in peak season, 1.2 million might be anomaly in off-peak

✅ Dynamic threshold: "Alert when deviation exceeds 2 standard deviations from recent baseline"
Advantage: Automatically adapts to data's seasonal and trending changes

AskTable's anomaly detection uses dynamic thresholds with core logic:

Anomaly threshold = Baseline value ± k × Standard deviation

Where k value auto-adjusts by scenario:
- Daily monitoring: k = 2 (alert only at 2 standard deviations, reduce false positives)
- Key metrics: k = 1.5 (core metrics more sensitive)
- Promotional period: k = 3 (more fluctuation during promotions, relax threshold)

2.3 Excluding Interference: Holidays, Promotions, System Maintenance

Anomaly detection's biggest fear: "Crying wolf"—if known events are treated as anomaly alerts, users will soon ignore all alerts.

AskTable automatically identifies and excludes known interference factors:

---

III. Typical Application Scenarios

Scenario 1: Daily Inspection — From "Person Finds Problem" to "Problem Finds Person"

Traditional approach: Spend 30 minutes daily opening various dashboards, checking each metric.

Anomaly detection approach: AskTable auto-inspects, discovers anomalies and proactively pushes.

📊 Anomaly Detection Report
Time: April 6, 2026 09:30

Found 2 significant anomalies:

1. ⚠️ Today's sales 780,000, down 22% from baseline
   - Biggest impact: East China (-35%)
   - Impact category: 3C Digital (-50%)
   - Impact time slot: 10:00-12:00
   → Suggest investigating East China 3C category inventory and system status

2. ⚠️ User conversion rate 2.1%, below normal range (2.8%-3.5%)
   - Mainly concentrated on mobile (1.5%)
   - PC normal (3.2%)
   → Suggest investigating mobile payment process

Scenario 2: Attribution Analysis — "Why Did It Drop So Suddenly?"

When user proactively asks, anomaly detection skill links with other skills (drill-down, attribution) to provide complete analysis.

User asks: "Why did today's sales drop so much?"

AskTable's response structure:

1. •Confirm anomaly: "Today's sales 780,000, down 22% from 7-day average, significant anomaly."
2. •Dimension breakdown: "Decline mainly from East China (-35%), other regions basically normal."
3. •Root cause location: "East China's 3C digital category orders dropped 50% sharply after 10am, suspected stockout or system failure."
4. •Historical comparison: "Similar pattern occurred once in November last year, then due to payment interface failure, lasted about 3 hours."
5. •Action suggestion: "Recommend immediately investigating East China 3C category inventory status and payment interface."

Scenario 3: Trend Alert — Spotting Signs Before Problems Erupt

Not all anomalies are "sudden drops." Some are slowly deteriorating trends, harder to detect, but more harmful.

Scenario: A SaaS product's user renewal rate
- Past 3 months: 95% → 94% → 93% → 91%
- Monthly decline 1-2 percentage points, each month doesn't seem abnormal
- But trend detection found: 3 consecutive months decline, cumulative drop 4 percentage points

→ Alert: Renewal rate shows continuous下滑 trend, suggest paying attention to customer satisfaction

This trending anomaly detection relies on identifying sequence patterns, not single-point judgment.

---

IV. Practical: How to Use Anomaly Detection Skill

4.1 Direct Conversation Trigger

In AskTable, you don't need to manually configure any rules—just ask in natural language to trigger anomaly detection:

"Is there anything unusual in recent data?"
"Were last week's sales normal?"
"Are there any metrics that seem off recently?"

AskTable automatically:

1. •Identifies your intent as "check anomaly"
2. •Activates anomaly detection skill
3. •Scans your currently connected data sources
4. •Returns anomaly detection report

4.2 Active Monitoring Mode

If you want AskTable to continuously monitor certain metrics:

1. •Select a built-in agent (like "Store Operations Analyst" or "E-commerce Data Monitor")
2. •Connect your data source
3. •Agent automatically inspects at set frequency, proactively pushes anomalies

4.3 Custom Anomaly Rules

If your business has special anomaly definitions, you can create custom anomaly detection rules in AskTable's Skill Editor:

You are a retail store anomaly detection expert.

Metrics to watch:
- Sales, customer traffic, average order value, inventory turnover

Anomaly definitions:
- Single-day sales below 7-day average by 20% → Significant anomaly
- Customer traffic declining 3 consecutive days → Trending anomaly
- Inventory turnover below 2 → Slow-moving alert

Report format:
- List all anomalies first (sorted by severity)
- Each anomaly with possible cause and troubleshooting suggestions
- Maximum 5 items, avoid information overload

---

V. How Anomaly Detection Links with Other Skills

Anomaly detection doesn't work in isolation. In real analysis, it forms a complete workflow with other skills:

Anomaly Detection (Discover problem)
    ↓
Drill-Down Metrics (Locate problem scope)
    ↓
Attribution Analysis (Find problem cause)
    ↓
Metric Interpretation (Translate to business language)
    ↓
Report Orchestration (Output analysis results)

For example:

1. •Anomaly Detection finds "sales down 22%"
2. •Drill-Down Metrics locates "East China 3C category"
3. •Attribution Analysis quantifies "inventory stockout contributed 60% of decline"
4. •Metric Interpretation translates to "For every 100 people who wanted to buy, 60 didn't buy due to stockout"
5. •Report Orchestration generates complete anomaly analysis report

This skill-linking capability is the core value of AskTable agents.

---

VI. Customer Case

A certain chain retail brand: From "Hindsight is 20/20" to "Real-Time Alert"

Pain point: 200 stores, regional managers manually aggregate data daily, average anomaly discovery lag 1.5 days. By the time problems are found, losses have already occurred.

Solution: Deploy "Store Operations Analyst" agent, enable anomaly detection skill, connect POS and inventory systems.

Effects:

• •Anomaly discovery time: From 1.5 days lag → Alert within 5 minutes
• •Q1 2026 total: 47 significant anomalies detected, 42 resolved same day
• •~1.2 million yuan in potential sales losses avoided through timely discovery
• •Regional managers save 1 hour daily in data inspection

"Before, problems happened and we only knew the next day from the daily report. Now we get push notifications 5 minutes after anomaly occurs, and can handle it same day. This change is huge." —— East China Operations Director, a certain chain retail brand

---

Summary

Anomaly detection's value isn't in "discovering data has problems," but in shortening problem discovery time from 'days' to 'minutes,' transforming personal experience-dependent inspection into automated system capability.

AskTable's approach isn't simply setting alert thresholds, but:

1. •Understanding data's normal patterns (baseline + volatility + seasonality)
2. •Dynamically adjusting judgment standards (not rigid rules, but living standards)
3. •Auto-excluding known interference (holidays, promotions, system maintenance)
4. •Pointing to problem roots (recommending drill-down dimensions, not just saying "there's problem")
5. •Linking with other skills (from discovering problems to locating problems to outputting reports)

Good anomaly detection doesn't tell you "data is wrong," but tells you "where it's wrong, why it's wrong, what you should do."

---

Extended Reading

• •AskTable Built-in Skills and Agents - Complete list of 11 skills and 9 agents
• •11 Skills + 9 Agents: How AskTable Packages Data Analyst Capabilities into AI - Deep dive into capability packaging methodology
• •AskTable AI Agent Architecture - Understand how skills are invoked by agents