Anomaly detection pipeline template

Components in this data flow diagram

• Metrics, logs & transactions
• Kafka topics
• Flink: windowed features
• Seasonal baseline per entity
• Isolation Forest / autoencoder scoring
• Combined anomaly score
• Score above dynamic threshold?
• Store as normal
• Duplicate of open alert?
• Attach to existing alert
• Severity
• Page on-call via PagerDuty
• Create Jira ticket
• Analyst investigates
• True anomaly?
• Remediate & record root cause
• Mark false positive
• Labelled feedback set
• Weekly retrain & threshold tuning

How to use this data flow diagram template

1. Click Open in the editor. The data flow diagram opens on a new page in FlowDiagram — nothing is uploaded and there is no sign-up.
2. Rename, add or delete shapes and drag them where you want; connectors stay attached as things move.
3. Drop in vendor logos from the library — 1,160 of them, including every AWS, Azure and Google Cloud service icon — or restyle it with the colour and theme controls.
4. Prefer text? Edit the Mermaid source below and paste it in through ☰ → Import diagram (see the Mermaid editor); it imports as an editable diagram.
5. Export to PNG, SVG or PDF, or press Ctrl+L for a link that carries the whole diagram.

Mermaid source

The whole template is the text below. Paste it into FlowDiagram, keep it in Git next to the code it describes, or hand it to an AI assistant to extend.

flowchart TD
  SRC[Metrics, logs & transactions] --> KAFKA[Kafka topics]
  KAFKA --> FLINK[Flink: windowed features]
  FLINK --> BASE[Seasonal baseline per entity]
  FLINK --> MODEL[Isolation Forest / autoencoder scoring]
  BASE --> SCORE[Combined anomaly score]
  MODEL --> SCORE
  SCORE --> THRESH{Score above dynamic threshold?}
  THRESH -->|No| NORMAL[(Store as normal)]
  THRESH -->|Yes| DEDUP{Duplicate of open alert?}
  DEDUP -->|Yes| MERGE[Attach to existing alert]
  DEDUP -->|No| SEV{Severity}
  SEV -->|Critical| PAGE[Page on-call via PagerDuty]
  SEV -->|Minor| TICKET[Create Jira ticket]
  PAGE --> ANALYST[Analyst investigates]
  TICKET --> ANALYST
  MERGE --> ANALYST
  ANALYST --> REAL{True anomaly?}
  REAL -->|Yes| ACTION[Remediate & record root cause]
  REAL -->|No| FP[Mark false positive]
  ACTION --> FEEDBACK[(Labelled feedback set)]
  FP --> FEEDBACK
  FEEDBACK --> RETRAIN[Weekly retrain & threshold tuning]
  RETRAIN --> MODEL

Related: Data pipeline diagram tool · Mermaid editor · All ai & ml pipelines templates · All 521 templates