Interpreting anomaly detection results

[lcawl]

Our content about how to interpret anomaly detection job is currently spread about and it would be useful to see if it can be improved by pulling it together into a procedure that (ideally) could then be re-used in whole or in part in multiple solutions.

It should include:

• Differences between Anomaly Explorer and Single Metric Viewer (covered at high level in tutorial)
• Information about what you can glean from influencers
• Interpreting multi-bucket anomalies
• A summary of the different types of results (e.g. model plot results, influencer results, bucket results, record results
• Interpreting anomaly scores and how they are calculated and how they differ from probability.(covered at high level in tutorial)
• Meaning of "actual" and "typical" values (covered at high level in tutorial)