// tool reference · Monitoring & Detection
Log Anomaly Detector Free
Statistical anomaly detection over log data — no signatures required.
What it does
Finds statistical outliers in logs without any signature: frequency spikes, rare events, and timing regularity.
When to use it
- Hunting rather than alerting. Useful when you do not know what you are looking for.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| log | textarea | required | Log lines. |
What you get back
Outliers with the statistical reason each was flagged.
Worked example
Input
10:00 GET /api/users 200 (x420 over the hour) 10:00 GET /api/export 200 (x3) 03:14 GET /api/export 200 (x1) 03:14 GET /api/users?limit=99999 200 (x1)
Output (abridged)
ANOMALIES
HIGH /api/users?limit=99999 at 03:14
Parameter value is a 4-sigma outlier vs the observed distribution
(typical limit: 20-50). Combined with the hour, this reads as
enumeration rather than use.
MEDIUM 03:14 activity cluster
Two export/bulk calls in a window with otherwise zero traffic.
RARITY is the signal -- not volume.
Note: 420 calls to /api/users is the BASELINE, not an anomaly. A volume
alert would have fired on the wrong thing.
How it works
Deterministic statistics. Offline.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
Statistics without semantics. It flags what is unusual, not what is bad -- a legitimate quarterly batch job is a perfect anomaly. You supply the meaning.
Privacy
Analysed in memory. Not stored.
Standards
NIST CSF (DE.AE)