Create a monitor via POST /api/v1/monitor with type set to metric alert and a query using the anomalies() function: anomalies(metric_name{scope}, 'algorithm', deviation_count)
Choose the algorithm parameter: basic for metrics without seasonality, agile for metrics that shift level over time, or robust for metrics with frequent spikes that should not reset the baseline
Set the deviation_count threshold (e.g., 2) to control sensitivity; lower values alert more aggressively and higher values require a larger deviation before firing
Configure the thresholds object with critical and warning values (expressed as fraction of time anomalous, e.g., 1.0 means the entire evaluation window must be anomalous for critical)
Set options.seasonality to hourly, daily, or weekly so the model accounts for time-of-day or day-of-week patterns in the metric
Validate the monitor by viewing the Preview graph in the Datadog UI to inspect historical anomaly detection overlays before enabling notifications
Known gotchas
Anomaly detection models require several weeks of historical data to learn seasonality patterns; monitors created against new metrics or during low-traffic periods will have inaccurate baselines for the first few weeks
The agile and robust algorithms use SARIMA models which are computationally expensive; applying them to very high-cardinality queries with many groups can slow monitor evaluation
Anomaly monitors cannot be used as SLO monitors in Datadog; if you need both anomaly alerting and SLO tracking on the same metric, create separate monitor and SLO objects
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp