Zabbix 5.2 introduced new trend functions useful for baseline monitoring. However, they still require defining relative thresholds (e.g. check that web traffic in September, 2021 is less than 2x higher compared to September, 2020). There are use cases when such thresholds are hard to define. For instance, the web traffic of a new but highly popular web site can organicaly grow many times over a year but the growth rate is unknown. Yet, a sudden traffic spike due to DDOS attack must generate an alert regardless of organic traffic growth.

Anomaly detection algorithms do exactly this - find data that don't look normal (outliers) in a context of other values. This AC specifies anomaly detection by the method called decomposition. From the start Zabbix must support one decomposition algorithm - STL. More anomaly detection algorithms will be added in the future.