Anomaly Detection: Reading Guide

September 2026 · 4 min read

Isolation Forest isolates observations through random axis-aligned cuts: points separated in fewer cuts receive higher anomaly scores. Turning that score into a reliable production workflow requires three pieces: a well-defined telemetry feature row, a calibrated forest score, and a grouped review queue.

Three artifacts make the workflow reviewable

Define the observation → calculate the score → admit a case

1 · Feature contractApp–tenant pair, seven-day window, event count, exposure, collection coverage, and peer reference.

A rate of 6 is meaningful only after its unit and exposure denominator are defined.

Inspect the row’s meaning

2 · Fitted detectorSaved training reference, feature transforms, trees, path correction, score direction, and version.

Shorter average paths produce larger anomaly scores.

Inspect the actual trees

3 · Reviewable caseGrouping key, member evidence, admission rank, budget rule, and timestamped outcomes.

A three-case limit must count investigations, not duplicate rows.

Inspect the admitted cases

Changing a cutoff changes labels without changing the forest. Changing a feature’s geometry changes the forest itself. Grouping changes what the review budget counts.

Three chapters, three questions

How do cuts become an anomaly score?

Compare first-cut intervals, follow queries through a reproducible three-tree forest, and calculate corrected path lengths $h_t(x)$ and normalized scores $s(x) = 2^{-\bar{h}(x)/c(\psi)}$.

Which behavior should count as unusual?

Switch between app and app–tenant rows, apply Empirical-Bayes exposure smoothing $r_{\mathrm{smooth}} = \frac{c + k r_0}{n + k}$, derive $\operatorname{log1p}$ cut mappings, and separate observed zeros from collection gaps.

Which cases should reviewers receive?

Compare score cutoffs and capacity caps across days, group rows into cases before applying a budget, and decompose single-feature attributions in path vs. score space.

Quick concept lookup

Direct routes to each core mechanism and edge case.
Behavior or edge case	Where it is derived
Queries 20 and 100 receive the exact same score.	Existing leaves and unseen queries
The predicted outlier label changes while the ranking stays fixed.	Raw scores versus threshold offsets
The global rate looks normal ($2.04$) despite a $3\times$ local spike ($6.0$).	Aggregation unit and Simpson masking
$\operatorname{log1p}$ preserves ordering but shifts random cut probabilities.	Uniform draws in transformed coordinates
Zero events may mean a logging outage or zero exposure.	Coverage and eligibility states
Three admitted rows collapse into a single investigation.	Grouping before applying the budget
A negative SHAP value ($-1.4667$) increases the anomaly score.	Path-space vs. score-space attributions

Reproduction scripts and related chapters

Every number and figure in this series is generated from small, inspectable fixtures: the forest script (JSON fixture), the cut-geometry script (CSV values), and the queue grouping implementation (JSON fixture). For multi-feature SHAP attributions on trees, see the Isolation Forest SHAP chapter; for precision, recall, and outside-queue auditing, see Evaluate Graph Risk.