Anomaly Scan & Diagnosis

Anomaly Scan & Diagnosis answers the question you ask when you don't yet know what is wrong: is anything in this data off — and if so, what caused it? You hand it a set of records, and it checks every variable in each one against what the Digital Twin expects, flags the records that don't fit, and — with one setting enabled — automatically runs Root Cause Analysis on each one it flags.

For the workflow that produces a Digital Twin in the first place, see Step 5: Build Digital Twin.

Anomaly Scan vs. Root Cause Analysis. They are two halves of the same idea. Root Cause Analysis is deliberate: you already know a value looks wrong, name it, and ask for the cause. Anomaly Scan & Diagnosis is the discovery step before that: it watches every variable for you, surfaces the records that don't fit, and then diagnoses each one — so you don't have to know what is wrong to begin with.

---

How it works: every variable, every record

A trained Digital Twin learns the expected relationships among all the variables, so for any record it can say, for each value: given everything else I know about this record, here is the value I'd expect, and the range it should fall in. The gap between observed and expected is a deviation, measured as a z-score — the number of standard deviations the observation sits from expectation:

• A z-score near 0 is in line with expectation.

• |z| ≥ 2 is uncommon (≈1 in 20), |z| ≥ 3 is rare (≈1 in 370), |z| ≥ 4 is extreme (≈1 in 16,000).

Root Cause Analysis scores deviations along the path upstream from one variable you name. Anomaly Scan does the wider job first: it scores every variable in every record you give it, and flags any sample that carries a deviation large enough to clear your sensitivity threshold. Where Auto-RCA is enabled, each flagged sample is then handed to Root Cause Analysis automatically, so the scan returns not just which records are anomalous but why.

---

Starting a simulation

Open your trained Digital Twin from the Digital Twins list.

Anomaly Scan runs against a trained Digital Twin — the same causal model that powers every other simulation type.

Open the Simulate tab, click New Simulation, and choose Anomaly Scan & Diagnosis from the type picker.

The Anomaly Scan setup as it opens. There is no variable to name — the scan checks every variable in every record you provide.

---

Step 1: Provide the observed data

Supply the records you want to scan. Each row is one independent sample; the system checks every variable in every row. As with Prediction, you can enter records by hand (Field Input), upload a File, or pull rows from a Data View.

Each record carries the full profile — services, contract, charges, tenure, and the observed outcome. The platform validates required fields before it will run.

Observed data on the Data View tab: pick a view and its records load as the samples to scan; here each of the three views carries 4,998 rows. Only columns matching the twin's variables are imported. The detection settings follow below.

---

Step 2: Detection settings (optional)

These tune how sensitive the scan is, and whether it diagnoses on its own.

• Target false-positive rate — the slider runs from 0.1% (strict) to 5% (loose). A lower rate flags fewer records and reduces false positives; a higher rate flags more. The default is 0.50%.

• Automatically run root cause analysis on anomalous samples — when ticked, every record the scan flags is passed straight to Root Cause Analysis. This is the Diagnosis in the name: the scan finds the anomaly, the diagnosis explains it. Leave it on unless you only want the flag.

Pick the twin version to run on, review the Configuration Summary, and click Run Simulation.

---

Running the scan

Scanning every variable across every record — and diagnosing each flagged one — is heavier than a single prediction. Expect a run to take minutes rather than seconds.

The scan in progress. The sidebar restates the run — every variable across 4,998 samples, 0.50% target FPR, Auto-RCA enabled. Expect minutes, not seconds.

---

Reading the result

The result opens with the headline verdict — how many anomalies were found across how many samples — followed by the z-score legend and a Samples table. Each anomalous sample is one row, carrying its severity, the variables that were flagged, and (with Auto-RCA on) its diagnosed root cause. Click any row to open its full Root Cause Analysis. Clean samples are hidden by default; toggle Show normal samples to see them.

A completed scan. The headline states the count, the charts show where the anomalies sit, and the samples table below lists each flagged record with its diagnosed cause.

In this run, the verdict was 28 of 4,998 samples anomalous:

28 of 4998 samples anomalous. 4998 samples scanned · target FPR: 0.50%.

The two charts unpack that count. The score distribution shows the overwhelming majority of records sitting far below the anomaly threshold, and the most frequently flagged variables chart shows the anomalies concentrating in TotalCharges and MonthlyCharges. With Auto-RCA on, the diagnosis goes a step further: it points to MonthlyCharges as the top cause behind the worst TotalCharges anomalies, so the issue is concentrated around those two variables rather than scattered across the model.

That grounding is the point, and it mirrors Root Cause Analysis: the answer comes from the causal model and the evidence in front of it. When a record genuinely deviates, the scan flags it and, with Auto-RCA, traces the cause. When nothing deviates, it says so. The answer is always defensible, because it never invents one.

---

Other Simulation Types

• Prediction — the most likely outcome for a specific input.

• Intervention — change a single variable and observe propagation.

• Optimization — find the input combination that best meets a goal.

• Best Action — the minimum change needed to reach a target outcome.

• Explanation — the drivers and impacts behind an outcome.

• Root Cause Analysis — diagnose a specific outcome you already know is wrong.

See Simulation Types for the full picture and Step 6: Run Simulations for the general overview.