Detection is the easy half, and the half everyone automates
Anomaly detection is a solved problem, and a finished alert is where most systems stop. The alert only says a number is unusual. The investigation, the expensive part, still happens by hand.
Investigating means choosing what to look at: deployment history, upstream row counts, campaign changes, a partner integration, seasonality. Which of those to pull depends on the metric and on what the first thing you pulled revealed.
That dependency is why a fixed investigation script underperforms. The second query should be chosen after seeing the first result. Only reasoning during the process can do that.
Knowing when to stop is the other judgment. An investigation that returns three plausible causes has not finished. An investigation that rules two out and says why is worth reading.
How the agent is built in Agent Studio
The system prompt bounds the investigation: which data sources it may query, a ceiling on how many queries one investigation may run, and the requirement to state what it ruled out alongside what it found.
Prompt skills carry your system topology, which pipeline feeds which table, and which metrics are known to move together, so the agent reasons about your architecture rather than inferring an architecture.
MCP connections and database access let the agent query the database. A read-only credential is the right choice here and belongs in Credentials rather than in a prompt instruction.
A flow triggers the agent. The threshold alert flow fires a Webhook, and the Agent Chat node passes the metric, the window, and the deviation size.
Findings reach Slack with the cause, evidence, a list of ruled-out causes, and a confidence value. The list of ruled-out items is what makes a finding checkable.
Google Sheets logs each investigation against its cause. Over a quarter, that table shows which causes the agent is good at and which it consistently misses. That comparison is more useful than any single investigation.
What this agent is built from
- System prompt: sets the query ceiling, the permitted sources, and the requirement to report what was ruled out.
- Prompt skills: carry your pipeline topology and which metrics are known to move together.
- PostgreSQL (Data): provides read-only query access. MySQL and MongoDB fit the same slot.
- Agent Chat (Util): the threshold alert flow automatically hands off the deviation.
- Slack (Communication): receives the cause, the evidence, the ruled-out list, and a confidence value.
- Google Sheets (Integration): logs investigations against actual causes for calibration.
- When an ActionFlow is enough: If detecting the anomaly is all you need, build the workflow with Math and a threshold. The agent is only for the investigation.
Frequently asked questions
Start building AI workflows
Create a free account, open a template or a blank canvas, and run your first ActionFlow.
Newsletter
Get product updates
New nodes, agents, and product notes. We send mail only when we have something worth opening.