AI ML Advisor¶
Overview¶
The AI ML Advisor was the first advisor TrackMe shipped, and the model the others adopted. It inspects and remediates native Machine Learning outlier-detection models — the density-function fits, the boundary configurations, the scoring timelines, and the period exclusions. It is the advisor you reach for when you ask “should I retrain?”, “is this outlier real?”, or “should I exclude this window from training?” — questions that previously required reading several SPL queries and the KV Store by hand.
The ML Advisor reasons about the model internals — distinct from the component advisors that tune the entity configuration on top of the model. It applies to any component with ML outlier detection enabled (DSM, DHM, FLX).
See The AI Advisors for the shared inspect/act model, the consent-card bridge, and the structured output contract, and Outlier detection for the underlying ML outlier detection feature.
When to use it¶
An entity is RED because of an outlier-score breach, but you suspect the model is over-sensitive or the training window included a known incident.
A retrain just completed and the model now flags healthy traffic as anomalous (a false-positive cascade).
The
isOutlierflag is sticky — the score will not return to baseline even after the anomaly has clearly passed.A density function’s boundaries look wrong compared to the entity’s actual traffic distribution.
The model is “low confidence” and you want to know whether more training data would help.
What it reads and writes¶
In inspect mode the advisor reads the full outlier context (identity, health, score breakdown, model rules, detection state and boundaries, confidence level), the raw metric history, the per-group fitted distributions and fit quality, the outlier-score timeline, the entity’s state-transition history, and the full training-window render (metric values, decided boundaries, flagged points).
In act mode it can additionally:
add a period exclusion to remove a contaminated window from the training set,
trigger a retrain (live or simulation),
set a false positive to neutralise the current outlier,
update model rules (density-function bounds, sliding-window size, seasonality flags, …),
enable / disable / reset outlier detection (the disable action is decommission-gated),
and attach labels and an investigation note to the entity.
A distinguishing field of the ML Advisor’s structured output is anomaly_windows — detected periods
worth excluding from training, each with a start, end, and reason.
Example 1 — a misbehaving model¶
The ML Advisor is launched from an entity’s Outliers anomaly detection tab via the AI ML Advisor button. In this example the model is misbehaving — producing a large number of lower-bound outliers that do not reflect a genuine data problem.
The advisor inspects the model, classifies the situation, and proposes remediation. In act mode an Additional instructions textbox lets you constrain the agent — for example “save investigations and remediations as a markdown-formatted note to the entity, and assign label under-review”.
Example 2 — a true positive with period exclusions¶
Not every anomaly is a false alarm. In this example the model has flagged a genuine anomaly (a true positive). The advisor inspects the score history and the training render, identifies the contaminated window, and — in act mode — applies period exclusions so the incident period does not poison future training, then retrains the model and documents its reasoning.
Note
Retraining is asynchronous — trigger_model_retrain returns once the retrain is queued,
not once it completes; the model is retrained on the next scheduled fit. Period exclusions are
additive — adding one does not replace existing exclusions. The advisor’s reasoning trace and the
on-entity note make both behaviours explicit.
Running it from the chat¶
The ML Advisor can also be proposed by the AI Assistant as a consent card when you describe an ML symptom in chat (e.g. “this outlier seems wrong”, “should I retrain?”, “exclude the last two hours from training”). See The AI Advisors.
Automated runs¶
The ML Advisor participates in the nightly automated batch, reviewing eligible entities with active
outliers within per-tenant policy. The model-disable action has its own dedicated guard
(ai_mladvisor_allow_model_disable, default off). See AI Agents automation.