After you have the proper aggregations, you can use stats methods e.g.: https://about.gitlab.com/blog/2019/07/23/anomaly-detection-u...