Start Demo

Investigate anomalies

When you find an interesting anomaly, you want to quickly understand the root cause. Addy performs an automated investigation for most anomalies, which means that you can view detail metrics in the anomaly description to immediately learn what contributed to an issue. When multiple factors contribute to an anomaly, you can also see the percentage of their contribution to the anomaly. For example, the following figure show which client, server, and URI are linked to an HTTP 404 anomaly.



Note:Automated investigation is not available for server processing time anomalies. For these anomalies, you can investigate anomalies from a protocol page in the Discover or Command appliance.

To learn more about the scope of an anomaly on your network, you can continue your investigation by opening an activity map or visiting a protocol page.

Open an activity map from an anomaly

When a single client or server is associated with unusual L7 protocol activity, such as a high number of HTTP errors or DNS request timeouts, an activity map link appears.

  1. Log into the Web UI on the Discover or Command appliance and then click Anomalies at the top of the page.
  2. Find the anomaly that you want to investigate. The following figure shows an example of the Activity Map link for a database server that sent an unusual number of errors.


  3. Click Activity Map.
    An activity map appears for the database server. The activity map in the following figure shows the two database clients that were connected to the server during the anomaly time frame.

You can now interact with the activity map to learn more about the effect of the database errors across the network:
  • Click any client in the map to access a menu that contains a Go to Device... link. Click the link to open a protocol page with client metrics, such as requests and responses.

  • In the left pane below Step 1, click Add Step and then click All Peers in the drop-down list. The map updates to show you which downstream devices are connected to the database clients, as shown in the following figure.

  • Save and then share your activity map with other ExtraHop users.

For more information about activity maps, see Activity maps concepts.

Navigate to a protocol page

If you want to further investigate anomalous metrics, you can navigate to a protocol page where you have access to additional charts, metrics, and tools.

  1. Log into the Web UI on the Discover or Command appliance and then click Anomalies at the top of the page.
  2. Find the anomaly that you want to investigate.
  3. Click the source name, as shown in the following figure.


    The anomalous protocol page for the device or application appears, which displays all of the metric data associated with that specific device or application during the anomaly time interval, as shown in the figure below.

Next steps

From a protocol page, you can then choose one of the following options to further investigate metric data:

Best practices for investigating anomalies

Addy provides you with high-quality, actionable data about anomalies—but does not replace decision-making or expertise about your network. The following best practices explain how to determine which anomalies are worth further investigation and when to take action.

Change the time interval to see when anomalies occurred
Learn if anomalies occurred before, after, or during a reported problem. For example, does the time frame of the anomaly coincide with a reported issue, such as slow load times or login times? You can also compare anomalies from the past month to the current date, which gives you a sense of whether the occurrence or severity of anomalies is changing over time.

For more information, see Find and filter anomalies.

Create an anomaly alert
You can configure an alert to receive email notifications when an anomaly occurs. Anomaly alerts also help you quickly find anomalies for a specific device or application on the Alert History page.

For more information, see Configure Addy anomaly alert settings.

Filter anomalies by protocol
Filter by protocol to quickly monitor critical protocols with a role in security, commerce, or communication processes.

For example, an FTP 530 error anomaly might indicate that someone is trying to gain unauthorized access to information on your network. Or Citrix server and client latency anomalies might indicate that users are experiencing long load times for their roaming desktop profiles.

Selecting different protocols can also show you how anomalies correlate to each other. An anomalous HTTP response time followed immediately by an anomalous CIFS server processing time might suggest that web servers are dependent on how quickly your file storage servers can send and receive file data.

For more information, see Find and filter anomalies.

Published 2021-04-13 10:05