> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Anomaly Detection — catch metric deviations before they become incidents

> Run on-demand statistical scans over your LLM traffic to detect latency spikes, error rate surges, and cost drifts — with plain-English explanations and automatic incident correlation.

Anomaly Detection scans your recent LLM events for statistical deviations and explains what it found in plain English. Select a time range, click **Detect Anomalies**, and the engine groups events by model, runs Z-score analysis against your baseline, and flags anything that falls outside normal range.

<Note>
  Anomaly Detection requires the **Team** plan or higher.
</Note>

<Tip>
  Looking for other AI features? [ZespanPilot](/dashboard/zespanpilot) handles natural language queries and project actions. [Cost Optimizer](/dashboard/costs#cost-optimizer) surfaces model-switching recommendations on the Costs page. Root Cause Analysis runs automatically on [Incidents](/dashboard/incidents).
</Tip>

## Running a scan

1. Open **AI Features** from the left sidebar.
2. Select a time range: **Last 1 hour**, **Last 24 hours**, or **Last 7 days**.
3. Click **Detect Anomalies**.

The engine groups events by model before running detection so a spike in one model doesn't mask healthy behavior in others.

## What gets detected

| Anomaly type    | Trigger condition                                     |
| --------------- | ----------------------------------------------------- |
| `LATENCY_SPIKE` | Z-score > 2.5 (high) or > 4.0 (critical) vs baseline  |
| `ERROR_SPIKE`   | Error rate > 10% with at least 3 errors in the window |
| `COST_SPIKE`    | Per-request cost increased > 1.5× from baseline       |

## What anomaly cards show

Each detected anomaly produces a card with:

* **Type** — `LATENCY_SPIKE`, `ERROR_SPIKE`, or `COST_SPIKE`
* **Severity** — `critical`, `high`, `medium`, or `low`
* **Description** — the specific metric values that triggered the detection
* **Affected models** — which models are showing the deviation
* **AI recommendation** — a plain-English suggested next step

## Incident correlation

Anomalies at `medium` severity and above are automatically correlated with your [Incidents](/dashboard/incidents) feed. `high` and `critical` anomalies also fire your configured [alert rules](/dashboard/alerts).

You can also manually open an incident from any anomaly card using the **Open incident** button.

<Note>
  If the scan returns no anomalies, your metrics are within normal range for the selected window. This is the expected result most of the time.
</Note>