Background: In recent months, Elastic has purchased Prelert and will actively incorporate it into the Elastic stack (and also discontinue the Splunk Anomaly Detective App!). I am trying to understand the theoretical methodology and process framework for their predictive analytics approach to time series anomaly detection so I can be an effective and efficient user of the Prelert tool.
Question: What topics to explore, and what is the general process flow/pipeline? How would one start to learn and understand the building blocks of the big concepts involved. I understand from a few posts online (1,2) a bit about how it works, but want to understand the major process items involved. At a high level, I get that there is some training set that fits a distribution via unsupervised ML, and that distribution is used to assess probability of future events - but need to get into the sequential processing blocks involved (for example, data read step, followed by sending it to a distribution-matching step, then some unsupervised ML step where a distribution is selected/adjusted, etc). I understand specifics may be difficult, so guesses and hypothetical ideas from people with experience in this arena would be great.
Note 1: I am not interested in the Prelert's "secret sauce" and the exact proprietary algorithms that they have developed - this would be unethical and I do not want to recreate their product, I just want to understand how to better use it. I am interested in an explanation of the main concepts implemented at a high level but in more detail than the posts (1,2) I found. Example post of the explanation could be in the form:
- 'distribution is populated via X concept/algorithm and then followed by selection step by Y machine learning concept/algorithm. Possible concepts to study are A,B,C. Key search words for literature searches are Q,W,E. Some references are N,M,L.'
Note 2: I have posted on a related topic before, but perhaps this is an interesting side question for a similar audience.