
The anomaly distribution chart
The chart in the top-right of the Results panel shows two overlapping bell curves. Together they answer a single question: how far is what the metric is seeing today from what it normally sees?The baseline curve (grey)
The baseline is built from historical run values — by default the last 4 weeks of observations for the metric on that asset. Prizm fits a statistical distribution to those values and stores:- μ (mean) — the centre of the expected range
- σ (standard deviation) — how wide the normal spread is A tall, narrow baseline curve means the metric has been very consistent historically. A wide, flat curve means the asset naturally varies a lot. The shape of the baseline is what makes anomaly detection self-tuning — an asset that normally swings by ±30% will not alert on a 20% change; an asset that is rock-steady will alert on a 5% change.
The current curve (dark/coloured)
The current curve represents the distribution of values from recent runs — typically the last 24–48 hours. Each run produces one data point; enough recent points form a distribution that can be overlaid on the baseline. The relative position of the two curves tells the story immediately:
In the screenshot, the current curve is shifted right of the baseline with a visible red tail — consistent with the Freshness metric receiving values well above the expected range.
How drift is calculated
Drift is the distance between the centre of the current distribution and the centre of the baseline, measured in standard deviations (σ).- Positive drift → values are higher than expected
- Negative drift → values are lower than expected The magnitude tells you severity — this maps directly to the priority bands:
How outlier % is calculated
Outliers % is the percentage of recent runs whose value fell outside the baseline’s expected range (beyond ±1σ by default, or a configurable threshold).
The Freshness screenshot (drift +2.4, outliers 18%) is a single spike pattern — the drift is significant but only a minority of runs are outliers, suggesting a specific event rather than a persistent shift.
Health states
Every metric is assigned one of four health states based on its recent alert history. The state appears as the badge in the Results panel header — for example, “Freshness Degrading (72%)”. The state is not a simple pass/fail. It is calculated using a priority burden score that weights recent alerts more heavily than older ones, so the state reflects what is happening right now, not just what happened in the past.Step 1 — Translate priority to points
Each alert run is assigned a point value based on the drift magnitude at the time of the alert:Step 2 — Apply recency weighting
Recent alerts carry more weight than older ones. Each alert’s points are multiplied by a recency factor:Step 3 — Compute priority burden
- Last run: 2 Medium alerts → (2 × 2) × 1.0 = 4.0
- Last 24h: 2 Medium alerts → (2 × 2) × 0.7 = 2.8
- Total burden = 6.8 → Degrading Example — Critical state:
- Last run: 10 Medium + 2 High alerts → (10×2 + 2×3) × 1.0 = 26.0
- Total burden = 26 → Critical
Step 4 — Map burden to state
Step 5 — Persistence override rules
Burden alone does not always capture the full picture. Two override rules can force a state higher regardless of the burden score: Force to Degrading if:- Alerts fired in 2 or more consecutive runs (any priority), OR
- High or Critical priority alerts repeat in consecutive runs Force to Critical if:
- Any Critical priority alert in the last run, OR
- Consecutive runs with High or Critical priority ≥ 3 in a row These rules ensure that a steady stream of moderate alerts — which might produce a moderate burden score — still escalates to Degrading, and that a recent Critical alert always results in a Critical state regardless of how clean prior runs were.
The percentage in the state badge
The percentage shown alongside the state — for example, “Freshness Degrading (72%)” — represents the overall anomaly burden score normalised to a 0–100% scale for the current observation window. A higher percentage means a heavier alert burden: more alerts, higher severity, or more recent occurrence.When a trust score is not available for a metric (Score: No), Prizm shows the state as “Freshness Degrading (High priority activity)” instead of the percentage. This applies to all operational metrics, which do not contribute to trust scoring.
The Results panel at a glance
AI insights
The AI Insights block in the Results panel is generated by an LLM that receives the metric’s computed signals and produces a plain-language summary. It follows a structured output template:- Trend summary — what the metric has been doing over the observation window
- Anomalies detected — what specific deviations occurred and when
- Alerts summary — how many alerts fired and at what priority
- Impact analysis — how many records or assets were affected
- Focus areas — where to look to diagnose and resolve the issue The AI insight shown in the screenshot is a textbook example:
“The metric shows a significant volume drop over the last 2 days, deviating 35% below the 4-week baseline. Three alerts were triggered, impacting approximately 120K records. This pattern aligns with previous ingestion delays. Focus should be on upstream pipeline stability and late-arriving data.”This maps directly to: trend (volume drop, 2 days) → deviation (35% below 4-week baseline) → alerts (3) → impact (120K records) → focus area (upstream pipeline, late-arriving data).
State transition lifecycle
A metric moves through states as its alert activity changes over time.Measure details page
Click a metric name from the Metric list to open its details page. The page is organized into a persistent header and three tabs: Overview, Timeline, and Audit.- Overview
- Timeline
- Audit
The Overview tab contains two sections: Summary and Results.
Summary
The Summary section shows an AI Summary — a Prizm-generated plain-language description of what the metric measures, why it matters, and the business context it operates in. The summary refreshes each time the metric runs.Results
The Results section shows the most recent alert and anomaly details.Sample Anomalies
Below the Results section, the Sample Anomalies table shows individual records that triggered alerts in the most recent run.Use the ALL filter button to toggle between all runs or a specific time range. The search, filter, and export controls in the table header let you drill into specific anomalies.

