The Ntuition Engine learns per-metric, per-host baselines and flags deviations. Its controls live under Settings → Ntuition Engine. Changes apply live; settings marked retrain below only take full effect after the next training cycle (or Retrain now).
Detection sensitivity
| Setting | Default | Effect |
|---|---|---|
| Anomaly score threshold | −0.05 | Isolation Forest score cutoff. More negative = only stronger outliers flagged. |
| Minimum deviation (σ) | 3.0 | A reading must also sit this many standard deviations from baseline. The most intuitive knob: raise to 4–5σ to quiet things down, lower to 2–2.5σ to catch subtler drift. |
| Contamination (retrain) | 0.05 | The fraction of training data assumed anomalous. Lower it if your history is clean; raise it if known-bad periods pollute training. |
Training schedule
| Setting | Default | Notes |
|---|---|---|
| Retrain interval (hours) | 24 | How often models refresh. |
| Training lookback (days) (retrain) | 7 | Window of history models learn from. Longer = steadier baselines, slower to adopt a "new normal." |
| Minimum training points (retrain) | 50 | Series with fewer points in the lookback are skipped rather than guessed at. |
| Aggregation bucket (seconds) (retrain) | 60 | Granularity of the series models see. |
The model status strip at the top shows anomaly/forecast model counts, last trained time, last cycle duration, and any error — check it after a retrain.
Excluded metrics
The Excluded metric patterns list (one SQL LIKE pattern per line) keeps metrics out of training entirely. Defaults exclude inventory-flavored SNMP series (snmp.ip.%, interface speed/status, system uptime) that would only produce noise. Add patterns for anything whose "anomalies" you never want to hear about.
The kill switch
Disable ML Analysis pauses detection and correlation immediately — the Analysis page reports unavailable — without touching the training schedule. It exists for "the fleet scan is loading the database and I need it to stop now." Re-enable when done.
A note on capacity headroom
Anomalies on resources running far below capacity are automatically downgraded to informational — a 4TB drive tripling its growth rate at 3% full is information, not a page. Don't be surprised when low-utilization oddities don't alert.
For per-metric and per-host exceptions, see Maintenance Windows and Tuning Rules.