> For the complete documentation index, see [llms.txt](https://docs.rootcause.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rootcause.ai/more-details/applications/application-modules/anomalysim.md).

# Anomaly Detection

> Detect anomalies and outliers using a Digital Twin.

Flags rows a digital twin did not expect, and says which variable makes them surprising.

Because the expectation comes from the twin rather than from a threshold, a row can be anomalous at values that are individually ordinary — it is the combination the model rules out. Note that the `anomalies` port carries every scanned case and not only the flagged ones.

## At a glance

|                          |                        |
| ------------------------ | ---------------------- |
| Module type              | `AnomalySim`           |
| Category                 | Intelligence           |
| Default tier             | `durable`              |
| Runs on                  | `reactive`, `durable`  |
| Starts a flow            | no                     |
| Holds a body             | no                     |
| Keeps state between runs | no                     |
| Available in             | every application type |

## Parameters

### `digitalTwinId`

`string` · required · defaults to `""`

The twin to run against.

### `digitalTwinName`

`string` · optional

Its name when it was chosen, for the node's label.

### `digitalTwinVersionIds`

`string[]` · optional

Pin the run to specific twin versions; empty means the latest.

### `scenario`

`Record<string, unknown>` · optional

The saved scenario. Anything arriving on the `scenario` port is merged over this.

### `scenarioDraft`

`Record<string, unknown>` · optional

What the inspector is editing, before it is applied to `scenario`.

### `scenarioValidationErrors`

`string[]` · optional

What was wrong with the draft the last time it was checked.

### `entityColumns`

`object` · optional · defaults to `{"id":null,"target":null,"constraints":null,"levers":null}`

Which columns of the `entities` frame carry what: `id` the environment id, and `target`, `constraints` and `levers` the optional per-row overrides. Any may be null.

## Inputs

| Port       | Kind        | Required | Description                                                                                                                           |
| ---------- | ----------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `on`       | `event`     | no       | Implicit on every module that does not itself start a flow: wire an event here to make this module the start of what that event runs. |
| `scenario` | `json`      | no       | Sensitivity and the window to score, per run.                                                                                         |
| `entities` | `dataframe` | no       | One row per environment to scan; `entityColumns` maps its columns.                                                                    |
| `baseline` | `dataframe` | yes      | The rows to score. Required: there is nothing to flag without them.                                                                   |

## Outputs

| Port        | Kind        | Connects to                | Description                                                                                                                                                               |
| ----------- | ----------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `anomalies` | `dataframe` | `dataframe`, `signal`      | One row per **scanned** case, flagged or not — `is_anomalous` is a column, and nothing filters on it. Also `entity`, `score` and `flagged_variables`. Filter it yourself. |
| `summary`   | `json`      | `json`, `scalar`, `signal` | The run's identity, not its findings: `{runId, status, outputs}`, where `outputs` is the simulator's raw per-version result. The numbers a reader wants are in `results`. |

***

[← All application modules](/more-details/applications/application-modules.md)