Work out anomaly threshold (z score) instantly with clear inputs, formula shown and shareable results.
A z-score threshold flags any observation more than z standard deviations from the baseline mean. Under a normal distribution the two-sided tail probability is 2(1 - Phi(z)), which is 0.27 percent at z = 3. Multiply that by observations per day and you get the alert volume you have implicitly signed up for — at 100,000 observations, z = 3 still produces about 270 false pages a day.
z-score thresholds
upper = mean + z x sd; lower = mean - z x sd; false positive rate = 2 x (1 - Phi(z))
Because the tail probability is multiplied by your observation count. High-volume metrics need z of 4 or 5, or aggregation into windows, to keep alert volume manageable.
Use robust statistics such as median and median absolute deviation, or empirical percentiles. Latency and traffic metrics are right-skewed and z-scores overflag their upper tail.