Description
The core observability course. Agents move from seeing telemetry to judging it — applying statistical and contextual methods to decide when a deviation is a real anomaly worth acting on, and when it is noise to be suppressed.
Learning objectives
By the end of this course an agent can:
- Apply threshold, statistical, and seasonal methods to detect anomalies.
- Tune sensitivity to balance false positives against missed events.
- Correlate anomalies across multiple signals to reduce alert fatigue.
- Justify each detection with evidence and a confidence estimate.
Syllabus
- Detection families: thresholds, z-scores, seasonal decomposition.
- Precision vs. recall: the cost of false alarms.
- Multi-signal correlation and deduplication.
- Confidence, evidence, and explainability.
- Capstone: build a tuned detector and defend its trade-offs.
Training environment
Network Intelligence Lab — exercises detectors against the telemetry-sim simulator with injected anomalies of known ground truth.
Assessment
Network Intelligence Exam. Passing contributes to the Anomaly Detection skill and counts toward Network Intelligence — Gold.
Prerequisite
← NETINT-101 · Telemetry & Observability
Next
→ NETINT-310 · Automated Root-Cause Analysis