Skip to main content
The Model Lifecycle page shows the current state of the TRACE anomaly detection model and lets authorized administrators promote or roll back model versions. Viewing this page requires the view_audit permission; promote and rollback actions require the manage_users permission.

Model status

The hero section at the top displays a verdict headline summarizing the current state of protection (e.g., “Your protection is running…”). It also shows:
  • Detection timing — when the model last scored events.
  • Change summary — a brief description of the most recent model change.
The shadow model version is not displayed in the UI. It is tracked internally and its presence controls whether the Promote button is enabled.

Health checks

A trigger log shows update recommendations from the system:

Performance journey

A chart showing three metrics over time:
  • Threats caught — the total number of threats detected by the model.
  • Real threats kept (TP retained) — true positives retained across model versions.
  • False alarms reduced (FP avoided) — false positives eliminated by model improvements.
Range toggles: 1M, 3M, 1Y, All. Click a version marker to view that version’s specific metrics. The most recent (current) version is selected by default.

Promote and rollback

Promote shadow to active

When a shadow model exists, you can promote it to become the active scoring model. This replaces the current active model. Promotion requires confirmation and the manage_users permission.

Rollback

If the active model is misbehaving, you can roll back to the previous version (or the baked-in base model if no prior version exists). Rollback also requires confirmation, the manage_users permission, and takes effect immediately.
When the deployment is running the baked-in base model (no prior versions and no shadow model), both the Promote and Rollback buttons are disabled.
Last modified on October 8, 2026