> ## Documentation Index > Fetch the complete documentation index at: https://docs.ultra.security/llms.txt > Use this file to discover all available pages before exploring further. # Anomaly Detection > Scheduled, AI-driven security analysis of your organization's MCP traffic Ultra's anomaly detection runs as a background process in Ultra Hub that periodically scans your organization's MCP traffic, identifies suspicious patterns with an LLM-based analysis engine, and records findings in the dashboard and audit log. Detection is asynchronous and centralized — individual gateways do not evaluate calls inline, so there is no per-call latency cost. Configure detection from **Anomalies** in the Hub sidebar. ## How It Works Detection runs on a schedule you choose. Each scan analyzes the MCP traffic recorded since the previous scan, looks for suspicious patterns, and writes any findings into the dashboard and the audit log. Everything runs inside Ultra Hub. Your gateways forward traces to the Hub as usual — there is no anomaly configuration in your gateway files, and nothing to deploy or maintain on the gateway side. ## Anomalies Page The **Anomalies** page (in the Hub sidebar) is the home for anomaly detection. It shows your detection settings, a 30-day summary, a risk-score trend, and the history of scan runs with their findings. A **Run scan now** button sits in the page header. ### Detection Settings The settings card controls whether detection runs and how often. Only owners and admins can change it. A status line shows whether scheduled scans are **Active** or **Paused**, along with when the setting was last updated. | Control | Options | Description | | ----------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Run scheduled scans** | On / Off | When enabled, Ultra scans your organization's traffic on the configured cadence and records findings. When off, no scheduled scans run and **Run scan now** is disabled. | | **Frequency** | 15m / 30m / 1h / 4h / 12h / 24h | How often Ultra re-scans your organization. Each run covers the time since the previous run. A shorter cadence surfaces issues sooner; a longer cadence reduces cost. | ### Run Scan Now The **Run scan now** button triggers an on-demand scan without waiting for the next scheduled run. A popover lets you pick how far back to look (15m, 30m, 1h, 4h, 12h, or 24h) before submitting. On-demand scans don't affect your scheduled cadence — the next scheduled scan still covers the full window since the last scheduled run. The button is disabled when: * You are not an owner or admin. * Scheduled scans are paused. * A scan is already running for your organization. * You triggered a scan very recently (a brief cooldown applies between manual scans). ### Summary Tiles Four tiles summarize the last 30 days: | Tile | What it shows | | ------------------ | ----------------------------------------------------------------------------- | | **Scans · 30d** | Total scan runs completed in the window. | | **Events scanned** | Total traces analyzed across those runs. | | **Findings · 30d** | Total findings produced, with a breakdown of how many were critical and high. | | **Current risk** | The highest overall risk score from the most recent run. | ### Risk Score Chart The **Risk score · last 30 days** chart plots the overall risk score for each scan run. Legend pills toggle per-category series so you can isolate a single anomaly category. A subline highlights how the latest run compares to the recent average and how many recent runs crossed the alert threshold. ### Run History and Findings Each scan run appears as a row showing its timestamp, the window it scanned (e.g. `May 7 → May 10`), whether it was scheduled or on-demand, the number of events analyzed, and the run's maximum risk score. Click a row to expand it and see every finding from that run. Each finding shows: * The **anomaly categories** that apply (a single finding may span several) * A **risk badge** and the number of affected traces * The **score**, **confidence**, and a **recommended action** (block, alert, or allow) * An **explanation** of the finding * The **affected users** involved * The **affected traces**, which link to the [trace detail](/observability/traces) The page updates automatically while a scan is running and refreshes the history when a run finishes. ## Anomaly Categories Findings are classified into the following categories, shown in finding titles and as toggleable series on the trend chart. A single finding can carry more than one category when activity matches a multi-stage pattern. | Category | What it covers | | ------------------------ | ----------------------------------------------------------------- | | **Enumeration** | Systematic discovery of tools, servers, or resources. | | **Privilege escalation** | Attempts to gain access or permissions beyond normal scope. | | **Data exfiltration** | Sensitive data read in bulk or sent to unauthorized destinations. | | **Injection** | Prompt or tool-call manipulation embedded in request payloads. | | **Credential abuse** | Credentials, tokens, or keys used or moved abnormally. | | **Evasion** | Activity that appears designed to avoid monitoring or controls. | | **Resource abuse** | Disproportionate or wasteful consumption of resources. | | **Behavioral anomaly** | Activity that deviates from an identity's established pattern. | ## Risk Levels Each finding carries a risk level that summarizes its severity: | Level | Description | | ------------ | ------------------------------------------ | | **None** | No anomaly detected. | | **Low** | Routine activity; informational only. | | **Medium** | Slightly unusual; worth monitoring. | | **High** | Suspicious; review recommended. | | **Critical** | Likely malicious; investigate immediately. | The vast majority of findings on healthy traffic are **low** or **medium**. High and critical findings are rare and should prompt a review of the affected traces and identities. ## Permissions Only owners and admins can: * Turn scheduled scans on or off. * Change the detection frequency. * Use **Run scan now**. Members and viewers can see the summary tiles, the trend chart, the run history, and every finding, but the settings and trigger controls are disabled for them. ## Configuration Reference Anomaly detection is configured per organization from the Hub UI. There is no equivalent in the gateway configuration file. | Setting | Type | Default | Description | | ------------------- | ---- | ------- | ------------------------------------------------------------- | | Run scheduled scans | bool | `false` | Master switch. When off, no scheduled or on-demand scans run. | | Frequency | enum | `30m` | One of `15m`, `30m`, `1h`, `4h`, `12h`, `24h`. | The analysis model and its supporting infrastructure are fully managed by Ultra and are not exposed to organizations. ## Next Steps Org-wide activity and recent findings at a glance Anomaly events alongside every other MCP operation Inline policy enforcement that complements scheduled detection Who can configure detection and trigger scans