Anomaly Detection

Ultra’s anomaly detection runs as a background process in Ultra Hub that periodically scans your organization’s MCP traffic, identifies suspicious patterns, and records findings in the dashboard and audit log. Detection is asynchronous and centralized. Individual devices do not evaluate calls inline, so there is no per-call latency cost. Configure detection from Anomalies in the Hub sidebar.

​

How It Works

Detection runs on a schedule you choose. Each scan analyzes the MCP traffic recorded since the previous scan, looks for suspicious patterns, and writes any findings into the dashboard and the audit log. Everything runs inside Ultra Hub. Your devices forward traces to the Hub as usual. There is no anomaly configuration in your device files, and nothing to deploy or maintain on the device side.

​

Anomalies Page

The Anomalies page (in the Hub sidebar) is the home for anomaly detection. It holds your detection settings, a summary of recent activity, a chart of findings, and a table you can switch between findings and scan runs. A Run scan now button sits in the page header. A time-range selector in the header (last hour, 24 hours, 7 days, or 30 days) scopes the summary tiles, the chart, and the table.

​

Detection Settings

The settings card controls whether detection runs and how often. Only owners and admins can change it. A status line shows whether scheduled scans are Active or Paused, along with when the setting was last updated.

​

Run Scan Now

The Run scan now button triggers an on-demand scan without waiting for the next scheduled run. A popover lets you pick how far back to look (the last 15 minutes, 1 hour, 4 hours, or 24 hours) before submitting. On-demand scans don’t affect your scheduled cadence. The next scheduled scan still covers the full window since the last scheduled run. The button is disabled when:

• You are not an owner or admin.
• Scheduled scans are paused.
• A scan is already running for your organization.

You can start another scan as soon as the previous one finishes.

​

Summary Tiles

Four tiles summarize the selected time range:

​

Anomaly Activity Chart

The Anomaly activity chart shows every finding in the range as a dot. Its lane is the severity (Critical, High, Medium, Low), its position is when it was found, its color is the anomaly type, and its size reflects how many events it involved. Hover a dot for its risk score, event count, and age. Click it to open the finding. Click an entry in the type legend, or a severity lane label, to show only that type or severity. Active filters appear as chips with a Clear filters button, next to a showing N of M count. If the range holds only a few findings, a note under the chart offers to widen it. If findings can’t be loaded, the page says so and offers Retry instead of showing an empty chart.

​

Anomalies and Runs

The table below the chart has two views, switched with Anomalies and Runs in its header. Anomalies is the default. It lists every finding in the range, newest first, with its type, when it was last seen, its risk, how many traces it involved, and the affected users. You can sort any column or group rows by anomaly type. Click a row to open the finding. Runs lists scan runs: when each ran, the window it covered, whether it was scheduled or on-demand, events analyzed, the run’s risk score, the anomaly types it found, and its status. Click a completed run to see its findings. Runs can be exported as CSV or JSON. Each finding shows:

• The anomaly categories that apply (a single finding may span several)
• A risk badge and the score, confidence, and recommended action (block, alert, or allow)
• A short summary of the finding
• The affected users involved
• The affected traces, which link to the trace in Traffic

Every finding a scan produces is listed with its score, including low and None findings. There is no score threshold to configure. Each finding opens in a drawer with its own shareable link. The page updates automatically while a scan is running.

​

Alerts on Findings

Anomaly findings can raise alerts in the Alerts feed and in any connected integrations. A Slack channel receives an anomaly alert when the alert’s severity matches that channel’s filter. Alerting is off until an owner or admin turns on Alert on detected anomalies in Alerts > Configuration. Anomaly alerts covers which findings raise an alert and who it is attributed to. An anomaly alert is titled Anomalous activity followed by the finding’s anomaly types.

​

Send a Test Alert

To see what an anomaly alert looks like, or to confirm an integration receives it, send a test. Only owners and admins can. Ultra adds an alert titled Test: Anomaly detection to the feed, with the context Test. It does not create a finding, traffic, traces, or audit events. Connected integrations receive a copy marked as a test. You can send a test while the switch is off. After sending one, wait a few seconds before sending another. To remove a test alert, open it and click Delete test alert. This removes it from Ultra only. A copy already delivered to an integration stays there.

​

Anomaly Categories

Findings are classified into the following categories, shown in the chart’s type legend, the Anomaly column of the Anomalies view, and the Types column of the Runs view. A single finding can carry more than one category when activity matches a multi-stage pattern.

​

Risk Levels

Each finding carries a risk level that summarizes its severity: The vast majority of findings on healthy traffic are low or medium. High and critical findings are rare and should prompt a review of the affected traces and identities.

​

Permissions

Only owners and admins can open the Anomalies page, change detection settings, or use Run scan now. Members and viewers don’t see it in the sidebar.

​

Configuration Reference

Anomaly detection is configured per organization from the Hub UI. There is no equivalent in the device configuration file.

​

Next Steps