To detect one higher anomaly, an example alerting rule could be: - alert : YourAwesomeAlertName expr : avg_over_time(anomaly_score[5m]) > 1 This examines the average anomaly score over the last period=5m and triggers if it’s above thld=1 . To reduce the chances of alerting fatigue, use for to ensure persistence of the anomaly before actual alerting (following VMAlert syntax and alert states): - alert : YourAwesomeAlertName expr : anomaly_score > 1 for : 10m This ensures the anomaly condition persists at least for period=10 minutes before alerting takes place. Collective anomalies involve a set of data points that, when considered together, deviate from what is expected, even though individual points may not qualify as anomalies.