Run Anomaly Triggers

In most cases, whenever anomaly triggers are violated, findings are automatically generated at the time when events are added or imported. However, there are some scenarios in which you must run anomaly triggers manually, including:

  • Anomaly triggers are updated and anomaly trigger limits have changed

  • Anomaly triggers exist on a calculation field

  • Before any finding review sessions

  • After a bulk import of event data (particularly when anomaly triggers rely on events other than itself)

You can run anomaly triggers manually on the Event Listing tab of the INSPECTION screen by choosing Shortcuts ‣ Anomaly Triggers from the toolbar. This will run the anomaly triggers functionality for the filtered events listed in the Event Listing tab. If required, the system automatically creates findings on those events where the event data exceeds specified criteria. If findings exist and event data no longer exceeds the criteria, then findings will be deleted. For more information, see the process below.

Prerequisites

Anomaly triggers have been defined in either of the following ways:

Run Anomaly Triggers Manually

  1. On the INSPECTION screen, go to the Event Listing tab.

  2. If required, filter the events or select those for which you want to run the anomaly triggers.

  3. Choose Shortcuts ‣ Anomaly Triggers from the toolbar.

  4. In the confirmation dialog, choose Run Triggers.

  5. The system uses the filtered list of events shown on the Event Listing tab to check event data against pre-configured anomaly triggers and performs the following:

    • If the event data exceeds specified criteria in the anomaly triggers:

      1. It checks the following data to see if a finding already exists from this trigger for this event:

        • Anomaly Trigger rule (Bound_ID)

        • Is Auto Generated = true

      2. If it finds no such finding, it creates a new finding.

    • If the event data is within the specified limits in the anomaly triggers:

      1. It checks if there’s a need to delete an existing finding by trying to match a finding based on the following data:

        • Anomaly Code (Code_ID)

        • Anomaly Severity (Severity_ID)

        • Reason (if there is an error message provided in the anomaly trigger)

        • Anomaly Trigger rule (Bound_ID)

        • Is Auto Generated = true

        • That it has not been linked to an anomaly (Anomaly_ID is null)

        • Anomaly Required is null

      2. If it finds a matching finding, it deletes the finding.

        This means that if a finding was automatically generated from a particular anomaly trigger rule, and the event data no longer exceeds that rule (because the event data has been changed or because the rule has been changed), and the error message in that rule still matches the Reason in this finding, and the finding has not been linked to an anomaly and the user has not marked whether it needs to be linked to an anomaly, the system will delete it.

Note

If you delete an anomaly trigger, findings created from it won’t be deleted. If you want to delete all findings created from an anomaly trigger, don’t delete the anomaly trigger. Instead, modify it so that no data will be marked as anomalous (for example, you can set it to only flag data between -2 and -1 on a field with no negative values), then run the anomaly triggers functionality. Then, as a second step, you can delete the anomaly trigger.