Intelligence: anomalies and external change

Baseline-driven anomaly episodes with no thresholds to set, and External Intelligence — DNS, TLS, HTTP fingerprint, content and infrastructure change detection with suppression rules.

Anomalies

Thresholds miss the slow creep. PulseTrace baselines each signal — latency, availability, external fingerprints — per monitor, and opens an episode when a signal steps outside its own normal. An open episode is one tracked story with a start, the deviation observed and an end, not a stream of alerts. Episodes surface on the monitor, on the Intelligence page, and as anomaly_alert / anomaly_recovered events; a signal that keeps crossing in and out is reported once as anomaly_flapping.

• Team: latency anomaly baselines.
• Pro: full anomaly detection — availability, per-signal and flapping — plus the multi-signal correlation engine, which ties related episodes across monitors into one finding.

External Intelligence

Change detection for the things outside your code that still break users. Every check fingerprints the surfaces below; a difference becomes a change event with before and after, and material ones are sent as significant_change.

• DNS — answers per record type, and the nameservers that gave them.
• TLS — certificate, chain and issuer; a renewal is recorded, a different issuer is flagged.
• HTTP fingerprint — server signature and the security-relevant headers.
• Redirects and content — the redirect chain and a content hash of the page.
• Infrastructure and security — hosts discovered under your domain, and exposed-surface findings.
• Certificate Transparency and look-alike domains (Pro) — new certificates logged for your names, and registrations that resemble them.

Suppression rules

Not every change matters. A suppression rule (GET/POST/DELETE /api/v1/intelligence/suppression-rules) tells Intelligence which changes to record as expected — a CDN that rotates its edge certificates, a header whose value carries a timestamp. Suppressed changes remain in the timeline but do not raise events. A maintenance window with expected_changes does the same for a bounded period.

Discovery → findings → verification

Hostname discovery watches Certificate Transparency logs for names under your domains and lists what it finds — a forgotten subdomain, a certificate issued for a host you do not monitor — per monitor (GET /api/v1/monitors/{id}/discovered-hostnames) and organization-wide (/api/v1/discovered-hostnames). Domain verification lets you prove ownership of a domain so findings are attributed correctly. Each change event can be marked expected or annotated with a note (POST /api/v1/intelligence/{id}/expected, PUT …/{id}/note); these are person-only actions, so API keys cannot perform them.

Plan availability: change detection with suppression rules from Team; full change intelligence, correlation and the CT / look-alike watch from Pro.