Time-Series Anomaly Detection with Forecast Bands

An anomaly is a deviation from what you expected. A forecast band is a formal statement of what you expected. Put them together and you have an anomaly detector that adapts to the series instead of using a fixed threshold.

This guide explains the workflow, the threshold choices, and the failure modes.

CSV forecast studio

Paste a series, get a probabilistic forecast.

One value per row, or a date column plus one or more numeric columns. Timestral returns a median forecast and a likely range. The demo runs on the public Hugging Face Space; the API is the paid product.

1 · Paste or upload a CSV2 · Pick a horizon3 · Download the 21 quantiles

Upload CSV

Steps

Airline passengersMonthly salesWebsite visitsElectricity load

month,passengers 1949-01-01,112 1949-02-01,118 1949-03-01,132 1949-04-01,129 1949-05-01,121 1949-06-01,135 1949-07-01,148 1949-08-01,148 1949-09-01,136 1949-10-01,119 1949-11-01,104 1949-12-01,118 1950-01-01,115 1950-02-01,126 1950-03-01,141 1950-04-01,135 1950-05-01,125 1950-06-01,149 1950-07-01,170 1950-08-01,170 1950-09-01,158 1950-10-01,133 1950-11-01,114 1950-12-01,140 1951-01-01,145 1951-02-01,150 1951-03-01,178 1951-04-01,163 1951-05-01,172 1951-06-01,178 1951-07-01,199 1951-08-01,199 1951-09-01,184 1951-10-01,162 1951-11-01,146 1951-12-01,166

↗Run forecast1 credit per API call · the web demo is free while the public Space is available

The idea

1. Forecast the next point or the next window with a probabilistic model.
2. When the actual arrives, check whether it falls inside the forecast band.
3. If it falls outside the 98% band, flag it for review.

The band widens when the series is uncertain and narrows when it is stable. That is the advantage over a fixed threshold: the same detector works for a quiet series and a volatile one.

Choosing the threshold

• 80% band: many false alarms; useful for early warning, not paging.
• 95% band: a reasonable default for operational alerts.
• 98% or 99% band: fewer alerts, more missed incidents. Use it when the cost of a false page is high.

There is no universal threshold. Measure the false-alarm rate on a backtest and choose the band that matches your on-call capacity.

One-sided vs two-sided

A two-sided band flags both high and low outliers. A one-sided band flags only the direction that matters. For example, a traffic drop may be an incident; a traffic spike may be a launch. Configure the side per metric.

Separate the two questions

An alert answers two different questions:

1. Is the actual outside the expected range? (statistical anomaly)
2. Does it matter? (business impact)

A forecast band answers the first. It does not answer the second. A 2% deviation on a high-revenue metric may matter more than a 20% deviation on a low-traffic debug endpoint. Combine the statistical flag with a business threshold.

Handling seasonality and holidays

A model that ignores holidays will flag every holiday as an anomaly. Include a holiday or day-of-week covariate, or exclude known holidays from alerting. The same applies to promotions, releases and maintenance windows.

A practical workflow

1. Forecast the next window with a 98% band.
2. When the actual arrives, compute the deviation and the band.
3. If the actual is outside the band, create an alert with the forecast, the actual and the band.
4. Group alerts by series and time to avoid a storm.
5. Review the alert with a human; label it as a true or false positive.
6. Recalibrate the band monthly using the labels.

Failure modes

• Model surprise is not an incident. A structural break makes the model wrong, not the system broken. A wave of alerts after a launch may be expected.
• Missing data looks like an anomaly. A gap in the data can produce a zero or a weird value. Check data freshness before alerting.
• Too many alerts. If every series alerts every day, the detector is useless. Raise the threshold or aggregate.
• Too few alerts. If the detector never fires, it may be too wide. Check coverage on a backtest.

What to read next

• Probabilistic forecasting and the 21 quantiles — reading the band.
• How to evaluate forecasts — coverage and calibration.
• Time-series forecasting use cases — operations examples.
• API pricing — one credit per forecast call.

FAQ

Can Timestral detect anomalies directly?

It produces a forecast distribution. The anomaly flag is a rule you apply to the actual vs the distribution. That is usually more interpretable than a black-box anomaly score.

What band should I use for paging?

Start with 98% and measure the false-alarm rate. If on-call load is too high, raise the threshold or aggregate alerts.

Does the detector need retraining?

No training is required for zero-shot inference, but the band should be recalibrated as the series changes. Re-run the backtest monthly.