Simulate how many incidents would have generated on different anomaly detections settings - azure-sentinel

Dear KQL master/ expert,
I've been trying to find the most effective (elegant) solution to achieve what I'm trying to do. I'd like to hear from the community, thank you.
Situation:
Currently we have an anomaly detection rules named "Process execution frequency anomaly" running every hour, and generated a lot of false-positives
We would like to tune the analytic rule by changing "threshold" value in series_decompose_anomalies.
We would like to simulate the analytic rule running various different settings, to see how much incident it would be generated.
Issue/ Things I tried:
The idea was to simulate "as if" the analytic rule is running every hour 7 days back for example. Similar to "Result simulation" section.
I have been able to create a simulation in Workbooks for simple analytic rules, by adding make-series command at the end of the KQL line. However, for this specific anomaly detection rules, I haven't been able to recreate it. Most likely because the data is produced by series_decompose_anomalies function in memory.
Question:
Is it doable?
Did I approach this incorrectly?
Is it best to change the settings, and then do an evaluation in the next 30 days ?
Thank you for your thoughts and suggestions.

Related

The simulation model time slows down in virtual mode

I am currently building a model on a manufacture process line and the simulation was running fine without errors. Suddenly when I entered in virtual mode to run quickly the simulation, the model started to slow down although the step is high. I am trying to identify where the issue is but nothing is working. At a certain time , the simulation just stops while the step is still running.
This is a picture of the pallete, maybe the experiment is causing this.
You created an infinite loop, this can be triggered by various things in your model.
Likely, you have a ' while' loop not finishing, could also be a condition-based transition.
You need to find this yourself, though. 3 options:
(easy): Check the model logic yourself and find the problem
(easy): nudge yourself to where it stops with traceln commands (see where they stop showing, getting you closer to the culprit)
(harder): Use a profiler (google "AnyLogic profiling" or similar if you are not familiar)
Benjamin is correct, you have created an infinite loop. Click on the "Events" tab in the developer panel and see which events are scheduled to occur at about the time that your model slows down to 0 days/sec. You can also pay attention to the "Step: " counter at the bottom of the developer panel and see where the step count spikes - e.g., if your model has roughly 10k steps per day, and suddenly starts climbing to 400k steps around 25.99 days, you can pay attention to which things are happening in your logic at that time and narrow down where the infinite loop is created. traceln will also help immensely

Adding labor cost as the model simulates on AnyLogic?

I created a variable, called labour cost. And I want this to increase, for example by 40 every 900s that the simulation is run. Can this be done?
Add an event with the following properties:
Instead of variable, use the name of your total cost variable of course.
Anything can be done with AnyLogic ;)
Use a recurring event that triggers this code every 900s:
myVariable+=40;
This is very basic so I also suggest you dig into all step-by-step tutorials that come with the help :)

How to stop timeout in service block

I am modeling ticket system with various SLA. The model must contain several service blocks with different reaction time ( from 2 to 32 hours). In the service block only working hours should be taken into account. So in the service block timeout should stop when non-workong hours and on the weekend. Could you please kindly tell me how i can realize it?
Thank you very much in advance!
I can think of two answers, one simplified but works in many cases, the other more advanced and probably more accurate:
Simplified approach: I would set the model in hours and keep everything running as is without any stop. So, at the end of the simulation, if the total time is 100 hours and you know that you have 8 hours/day with 5 days/week, then you'd know the total duration is 2.5 weeks. Of course, this might have limitations or might become more complex later on if you want day-specific actions (e.g. you want to differentiate between Monday, Tuesday, etc.)
Advanced more accurate approach: Create resources whose capacities are defined by schedule and assigned them to your services. Create a schedule and specify the working hours in that schedule. Check the below link to learn more about schedules. I call this the more advanced approach because you need to make sure the schedule is defined correctly and make sure all elements in the model are properly controlled (e.g. non-service blocks such as source, delays, etc.).
https://help.anylogic.com/topic/com.anylogic.help/html/data/schedule.html?resultof=%22%73%63%68%65%64%75%6c%65%73%22%20%22%73%63%68%65%64%75%6c%22%20
I personally would use the first approach if the model is rather simple and modeling working hours is enough for analysis. Otherwise, I'd go for option 2.
Finally, another option I'd like to highlight is the "suspend/resume" functions. I am only adding this because you asked "how to stop timeout". So these functions specifically stop and resume timeout. But you'll need to define the times at which they are executed (through an event for example).

Is there a way to not start an Anylogic simulation from scratch every time?

Good day
I'm a new user trying to find my with Anylogic.
Any help with the following question will be appreciated.
Is it possible to start a model with initial values/quantities given to certain blocks/sections in a model? In other words not have the model start from 0 but from the values given.
You can run a "warmup" period manually and save that as a model snapshot. In future runs, you can start off from that snapshot by loading it. See the help on model snapshots
This is the general problem of model initialisation (e.g., if you're modelling a manufacturing facility, you may want the run to start with the facility at the state it would be at on 9am next Monday morning). There is no generic answer: what initialisation you need is 100% model-dependent (as is how easy/hard this is).
In particular, process models make this difficult because entities (agents) are expected to have flowed through the process up to the point they 'start' in. You can use things like extra initialisation-only Source/Enter blocks to 'inject' agents into the appropriate process points, but in most models it's not this easy: you will have all kinds of model state that needs to be made consistent with this (e.g., the agents flowing through the process might have attributes which have changed based on what's happened to them so far, so this would have to be made consistent).
That's why warm-up periods (letting the model run 'from empty' for a period until its state is qualitatively what you want as your starting point) is a common approach. Model snapshots can help you here (see Ben's answer) but they're not the only way of doing it. (You can also just 'reset' all your metrics/output gathering at the point when you determine the warm-up period has ended --- i.e., you are effectively establishing a new 'time zero' --- but, again, exactly what you need to do is 100% model dependent.)

Two questions of TradeStation charts

I am evaluating which one to choose, TWS from IB or TS. TWS has a demo account but TS does not. I have two questions about TS stock chart.
premarket data in charts start from 4am, or later? TWS starts from 4am. I know TS only allows trades after 8am. I am just wondering if premarket data in chart also starts late.
when premarket data is displayed along with regular trading hour data, HOURLY candle is aligned with 9am or 9:30am? TWS has hourly candle aligned with 9am not market opening time. I honestly don't like it. I am just wondering if TS does the same thing.
If anyone can answer me these two questions, I would be really appreciated!
Thanks,
Jay
You can set when you want TS to show you data from, in terms of sessions; if it's there, they'll find it. So yes, I can for example set my TS chart to show 'premarket' AAPL data from 0300 (or really any other time). I can't trade it before the exchange opens though, as that would be an OTC/ off-exchange trade which you have to be an institution to do.
Candles are aligned with 0930, but that doesn't matter; it can be changed in settings, also though when backtesting, you should use LIBB (Look Intra Bar).
Hope this helps! I strongly recommend you take a close look at MultiCharts too, using IQFeed data.
Also remember, all these systems are buggy as all hell. Managing workflow with them is as much about learning and overcoming their eccentricities, as it is doing the work.