Anomalies - Hilt Documentation

Anomalies is the queue of model-flagged findings. Custom rule firings live on Alerts, not here. Two tabs: Queue and Sensitivity. Sensitivity requires the manage alerts permission.

Tab: Queue

A docket of behavioral clusters. KPIs typically include volume at risk, sensitive touches, and how much has been reviewed. Inside the queue: Review, Accepted, and Denied. Selecting a finding opens an investigation overlay (narrative, graph, events) over the docket. Typical verdicts:

Action	Effect
Accept	Confirm as a real anomaly
Deny	Mark benign / false positive
Suppress	Deny and suppress matching future patterns

Tab: Sensitivity

Subtitle: Paths, users and hosts whose anomalies are surfaced and weighted more often. Maintain the sensitive-entity list so scoring treats those paths, users, and hosts with higher weight.

Rule firings → Alerts
Event search → Logs
Model lifecycle → Models
Findings via REST → Findings API

Last modified on October 8, 2026