Model Management

Model Initialization and Learn

This process generates a unique anomaly detection model for a signal. To initiate model learning, use the ANOMALYLEARN flow.

timeRanges:

A list of time ranges representing data behavior considered "normal" operation

signal:

The ID of the signal on which the model will be trained. This can be found on the "info" section of the signal on the signals tab.

Request Payload

{
    "flowType": "ANOMALYLEARN",
    "name": "Anomaly detection for current",
    "description": "default aperture",
    "spec": {
        "timeRanges": [
            {
                "startTime":"2024-07-27T01:30:00.000000000Z",
                "endTime": "2024-08-27T00:00:00.000000000Z"
            },
            {
                "startTime":"2024-09-27T01:30:00.000000000Z",
                "endTime": "2024-10-11T00:00:00.000000000Z"
            }
        ],
        "signal": {
            "id": "1353853719423311872"
        }
    }
}

Example curl request

curl --location --request POST 'https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/flows' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' 
--data-raw '{
    "flowType": "ANOMALYLEARN",
    "name": "Anomaly detection for current",
    "description": "default aperture",
    "spec": {"timeRanges": [{"startTime":"2024-07-27T01:30:00.000000000Z","endTime": "2024-10-11T00:00:00.000000000Z"},
    {"startTime":"2024-09-27T01:30:00.000000000Z","endTime": "2024-10-11T00:00:00.000000000Z"}],
    "signal": {"id": "1353853719423311872"}}}'

Example with python

Request

import requests 
import json
URL = 'https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/flows'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Content-Type': 'application/json'} 
PAYLOAD = {
    "flowType": "ANOMALYLEARN",
    "name": "Anomaly detection for current",
    "description": "default aperture",
    "spec": {
        "timeRanges": [
            {
                "startTime":"2024-07-27T01:30:00.000000000Z",
                "endTime": "2024-10-11T00:00:00.000000000Z"
            },
            {
                "startTime":"2024-09-27T01:30:00.000000000Z",
                "endTime": "2024-10-11T00:00:00.000000000Z"
            }
        ],
        "signal": {
            "id": "1353853719423311872"
        }
    }
}
response = requests.post(URL, headers=HEADERS, data=json.dumps(PAYLOAD)) 
print(response.json())

After initiating the ANOMALYLEARN flow, an anomaly model signal will be created, and the modelID will be the same as the flow ID. This model ID is then used for evaluations and making the model live.

Model Evaluation

To evaluate a learned Insights model, use the ANOMALYEVAL flow.

timeRanges:

A list of time ranges over which to evaluate the model (they do not need to be contiguous). For high data rates, consider breaking down long evaluation ranges into multiple Eval requests to increase evaluation speed.

model:

The ID of the model from your learn flow

signal:

The same signal ID that was used for learning the model

Request Payload

{
    "flowType": "ANOMALYEVAL",
    "name": "Anomaly detection for current",
    "description": "default",
    "spec": {
        "model":"1402745199344193536",
        "timeRanges": [
            {
                "startTime":"2024-09-01T00:00:00.000000000Z",
                "endTime": "2024-10-11T00:00:00.000000000Z"
            }
        ],
        "signal": {
            "id": "1353853719423311872"
        }
    }
}

Example curl request

curl --location --request POST 'https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/flows' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' 
--data-raw '{
    "flowType": "ANOMALYEVAL",
    "name": "Anomaly detection for current",
    "description": "default",
    "spec": {"model":"1402745199344193536",
    "timeRanges": [{"startTime":"2024-09-01T00:00:00.000000000Z","endTime": "2024-10-11T00:00:00.000000000Z"}],
    "signal": {"id": "1353853719423311872"}}}'

Example with python

Request

import requests 
import json
URL = 'https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/flows'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Content-Type': 'application/json'} 
PAYLOAD = {
    "flowType": "ANOMALYEVAL",
    "name": "Anomaly detection for current",
    "description": "default",
    "spec": {
        "model":"1402745199344193536",
        "timeRanges": [
            {
                "startTime":"2024-09-01T00:00:00.000000000Z",
                "endTime": "2024-10-11T00:00:00.000000000Z"
            }
        ],
        "signal": {
            "id": "1353853719423311872"
        }
    }
}
response = requests.post(URL, headers=HEADERS, data=json.dumps(PAYLOAD)) 
print(response.json())

The evaluation produces an "Anomaly Score" signal, which represents the deviation from learned behavior.

Incremental Learn

Incremental learning allows you to build upon existing models and add new knowledge as new behaviors occur or to reinforce learning within a chosen range. This is achieved using the same ANOMALYLEARN API as initial model learning, but you include the model ID of the original model you wish to build upon. It is not necessary to use the original time ranges from the initial learn.

timeRanges:

The new time ranges where data behavior is considered "normal" operation.

signal:

The signal ID which can be found under the "info" of the signal on the signals tab.

model:

The Model ID of the original model to be incrementally learned upon.

Request Payload

{
   "name": "AnomalyLearnFlow",
   "flowType": "ANOMALYLEARN",
   "spec": {
        "model": "1338619098414317568",
        "timeRanges": [
           {
               "startTime": "2025-01-23T11:13:26.000Z",
               "endTime": "2025-01-23T12:37:30.000Z"
           }
       ],
       "signal": {
           "id": "1332064119748558848"
        },
    }
}