What is Anomaly Detection?
Definition
Where Drift Detection compares a database's actual state against its expected state at a point in time, Anomaly Detection looks at patterns of activity over time, flagging things that look unusual even if no single change would trigger a drift alert on its own: an unusual number of changes in a short window, activity from an account that doesn't normally make changes, or a change pattern that doesn't match how that database is typically modified. This kind of pattern-based detection is particularly relevant for catching potential security incidents, where an unauthorized actor might make changes that are individually plausible but collectively don't match normal usage.
Why Anomaly Detection matters
Not every problematic change looks obviously wrong in isolation. A single unexpected column drop might just be an Out-of-Process Change; a burst of unusual activity from an unfamiliar account at an odd hour looks like something else entirely, potentially a compromised credential or an insider risk, even before anyone determines exactly what changed. Anomaly Detection is built to surface that second category, patterns that warrant attention even before a specific harmful change is identified, which is exactly the kind of signal that's easy to miss when reviewing changes one at a time.
How Anomaly Detection works
Rather than comparing state at a single point in time, Anomaly Detection typically analyzes activity patterns: frequency, timing, source, and type of changes, against a baseline of what's normal for a given database or team. Deviations from that baseline get flagged for review, even if each individual change would pass a standard Policy Check on its own, since the signal is in the pattern rather than any single action. Establishing a reliable baseline usually requires some history of normal activity before anomalies become meaningfully detectable.
How Liquibase helps
Liquibase Secure's Change Intelligence, combined with drift and policy signals, supports anomaly-style detection by giving security and operations teams a consolidated view of change activity across databases, making unusual patterns easier to spot than they would be scattered across separate, disconnected logging systems. Paired with Identity-Aware Access Control, this gives organizations both prevention, restricting who can make certain changes, and detection, flagging unusual activity when it happens anyway. Tuning how sensitive detection is takes some iteration, since a threshold set too tightly generates alerts nobody trusts anymore, while one set too loosely misses the pattern it was meant to catch in the first place. Reviewing flagged anomalies as a batch, rather than reacting to each one individually the moment it fires, often makes it easier to spot which alerts represent a genuine pattern worth investigating further.
