Cortex Anomaly · observability
See your servers' failures before anyone notices.
A lightweight agent, written in Go, reads each server's logs, learns what they look like on a healthy day and alerts when something that doesn't fit shows up. No regular expressions to write and no indexing everything into a cluster.
- On-premise
- Its own threshold per agent
- No regular expressions
The response is still a 200, but it takes much longer than usual for that service.
Cortex Anomaly
Observability that learns what normal looks like
Each service has its agent, trained on its own logs. There is no fixed limit that is the same for everyone, and no rules to write and maintain by hand.
-
Learns the healthy state
Each agent is trained on logs from a normal period and computes its own threshold. There is no fixed limit that is the same for everyone.
-
Ignores the noise, highlights what matters
It sets aside dates, durations and identifiers that change on every line, and amplifies status codes. Slowness is judged separately, with each service's percentiles: it is detected even when the response is still a 200.
-
End-to-end transactions
In SLA mode it follows each transaction through its life cycle, measures how long it takes and reconstructs it across the servers it passed through.
-
Doesn't lose what it detects
If the network goes down, it stores to disk and resends when it is back. Each event arrives at least once and without duplicates.
-
Enrollment with approval
Each agent generates its own identity and stays pending until an administrator approves it by comparing its fingerprint. The connection is always TLS.
-
Private logs
Optionally, it sends HMAC-SHA256 signatures of each line instead of the text. A service can have one or several agents.
Who it is for
- Operations and infrastructure teams
- Services whose transactions cross several servers
- Any organization with critical servers to watch
Frequently asked questions
What people usually ask about Anomaly
What does it take to start?
Install an agent on each server you want to watch and train it on logs from a normal period.
Do I have to write rules or regular expressions?
No. Each agent learns from logs of a normal period and computes its own threshold.
Does it send the text of the logs?
It doesn't have to: optionally, it sends HMAC-SHA256 signatures of each line instead of the text.
What happens if the network goes down?
The agent stores what it detects to disk and resends it when the network is back. Each event arrives at least once and without duplicates.
Where does it run?
The agents, on the servers they watch. The console and the engine, in your organization's data center, on standard processors, with no GPU, on enterprise Linux.
Want to see Anomaly on your servers?
We arrange a demo and show you how an agent is trained on your logs.