{"id":10434,"date":"2026-08-15T14:39:36","date_gmt":"2026-08-15T12:39:36","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/toolbox\/ecommerce-anomaly-threshold-planner\/"},"modified":"2026-08-15T14:48:51","modified_gmt":"2026-08-15T12:48:51","slug":"ecommerce-anomaly-threshold-planner","status":"publish","type":"page","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/","title":{"rendered":"E-Commerce Anomaly Threshold Planner"},"content":{"rendered":"<div class=\"gtm-analyser-container\" style=\"background: var(--bg-panel, #1e1e24); padding: 25px; border-radius: 8px; border: 1px solid var(--border, #2a2a35);\">\n<p style=\"color: var(--text-secondary, #a0a0b0); margin-bottom: 20px;\">An alert on add_to_cart is set to three sigma because three sounds careful, and then it either pages every night or stays silent through a broken checkout. Both outcomes follow from the volume, and both can be calculated before the first alert is configured.<\/p>\n<div style=\"display: grid; grid-template-columns: repeat(auto-fill, minmax(190px, 1fr)); gap: 12px; margin-bottom: 18px;\">\n<div>\n            <label for=\"an-protag\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Events per day<\/label><br \/>\n            <input id=\"an-protag\" type=\"number\" min=\"1\" step=\"1\" value=\"4800\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box;\">\n        <\/div>\n<div>\n            <label for=\"an-stunden\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Monitored hours per day<\/label><br \/>\n            <input id=\"an-stunden\" type=\"number\" min=\"1\" max=\"24\" step=\"1\" value=\"24\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box;\">\n        <\/div>\n<div>\n            <label for=\"an-ruhigste\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Quietest interval, % of average<\/label><br \/>\n            <input id=\"an-ruhigste\" type=\"number\" min=\"1\" max=\"100\" step=\"1\" value=\"40\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box;\">\n        <\/div>\n<div>\n            <label for=\"an-intervall\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Interval<\/label><br \/>\n            <select id=\"an-intervall\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box;\"><option value=\"5\">5 min<\/option><option value=\"15\">15 min<\/option><option value=\"30\">30 min<\/option><option value=\"60\" selected>60 min<\/option><option value=\"240\">4 h<\/option><\/select>\n        <\/div>\n<div>\n            <label for=\"an-k\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Threshold in sigma<\/label><br \/>\n            <select id=\"an-k\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box;\"><option value=\"2\">2<\/option><option value=\"2.5\">2,5<\/option><option value=\"3\" selected>3<\/option><option value=\"3.5\">3,5<\/option><option value=\"4\">4<\/option><\/select>\n        <\/div>\n<div>\n            <label for=\"an-streuung\" style=\"color: var(--text-secondary, #a0a0b0); display: block; font-size: 0.85rem; margin-bottom: 5px;\">Dispersion factor<\/label><br \/>\n            <input id=\"an-streuung\" type=\"number\" min=\"1\" max=\"5\" step=\"0.1\" value=\"1.8\" class=\"form-control\" style=\"width: 100%; padding: 10px; background: var(--bg-body, #14141a); border: 1px solid var(--border, #2a2a35); color: var(--text-primary, #e8e8ee); border-radius: 6px; box-sizing: border-box;\">\n        <\/div>\n<\/p><\/div>\n<p style=\"color: var(--text-secondary, #a0a0b0); font-size: 0.82rem; margin-bottom: 16px;\">Pure counting noise gives a dispersion factor of 1. Real traffic carries a daily and weekly rhythm on top of that, so a flat baseline sees a spread of roughly 1.5 to 2.5 times the counting noise. A factor of 1 is only honest against a baseline that already models the rhythm.<\/p>\n<p>    <button id=\"an-btn\" class=\"button\" style=\"background: var(--accent, #7ee787); color: #0b1114; border: none; padding: 12px 24px; border-radius: 6px; font-weight: 700; cursor: pointer;\">Calculate threshold<\/button><\/p>\n<div id=\"an-ausgabe\" style=\"margin-top: 22px;\"><\/div>\n<\/div>\n<p><script>\n(function () {\n    'use strict';<\/p>\n<p>    const T = {\"einleitung\":\"An alert on add_to_cart is set to three sigma because three sounds careful, and then it either pages every night or stays silent through a broken checkout. Both outcomes follow from the volume, and both can be calculated before the first alert is configured.\",\"label_protag\":\"Events per day\",\"label_stunden\":\"Monitored hours per day\",\"label_ruhigste\":\"Quietest interval, % of average\",\"label_intervall\":\"Interval\",\"label_k\":\"Threshold in sigma\",\"label_streuung\":\"Dispersion factor\",\"streuung_erklaerung\":\"Pure counting noise gives a dispersion factor of 1. Real traffic carries a daily and weekly rhythm on top of that, so a flat baseline sees a spread of roughly 1.5 to 2.5 times the counting noise. A factor of 1 is only honest against a baseline that already models the rhythm.\",\"knopf\":\"Calculate threshold\",\"h_schwelle\":\"Threshold per interval\",\"spalte_mittel\":\"average interval\",\"spalte_ruhig\":\"quietest interval\",\"zeile_erwartet\":\"Expected events\",\"zeile_sigma\":\"Standard deviation\",\"zeile_schwelle\":\"Alert below\",\"zeile_erkennbar\":\"Smallest visible drop\",\"h_alarme\":\"What that costs in attention\",\"zeile_intervalle\":\"Intervals per day\",\"zeile_fehlalarme_tag\":\"False alarms per day\",\"zeile_fehlalarme_monat\":\"False alarms per month\",\"h_tabelle\":\"The trade-off, measured at the quietest interval\",\"spalte_k\":\"Sigma\",\"spalte_fehlalarme\":\"False alarms\\\/day\",\"spalte_erkennbar\":\"Smallest visible drop\",\"h_hinweise\":\"What this setup means\",\"hinweis_zu_wenig\":\"Fewer than ten events in the quietest interval. At that size the count is too lumpy for a sigma rule; a longer interval is worth more than a different threshold.\",\"hinweis_zu_laut\":\"More than one false alarm a day. An alert that cries wolf daily is switched off within a fortnight, and then nothing is monitored at all.\",\"hinweis_sehr_still\":\"Fewer than one false alarm every fifty days. Quiet, and worth checking that a real outage would actually cross this threshold.\",\"hinweis_blind\":\"In the quietest interval only a drop of half or more is visible. A checkout that is broken for a tenth of customers passes unnoticed - lengthening the interval helps, because the detectable drop shrinks with the square root of the count.\",\"hinweis_reine_poisson\":\"A dispersion factor of 1 assumes the baseline already accounts for the daily and weekly rhythm. Against a flat average this produces alerts every evening and every Sunday.\",\"hinweis_keine_ereignisse\":\"Without a volume there is nothing to calculate.\",\"dezimal\":\".\"};<\/p>\n<p>    \/\/ --- Normalverteilung ----------------------------------------------------\n    \/\/ Fehlerfunktion nach Abramowitz und Stegun 7.1.26, Fehler unter 1,5e-7.<\/p>\n<p>    function erf(x) {\n        const vorzeichen = x < 0 ? -1 : 1;\n        const z = Math.abs(x);\n        const t = 1 \/ (1 + 0.3275911 * z);\n        const y = 1 - (((((1.061405429 * t - 1.453152027) * t) + 1.421413741) * t - 0.284496736) * t + 0.254829592) * t * Math.exp(-z * z);\n        return vorzeichen * y;\n    }\n\n    \/** Verteilungsfunktion der Standardnormalverteilung. *\/\n    function phi(z) {\n        return 0.5 * (1 + erf(z \/ Math.SQRT2));\n    }\n\n    \/\/ --- Rechnung ------------------------------------------------------------\n\n    function zahl(wert, ersatz) {\n        const n = Number(wert);\n        return isFinite(n) ? n : ersatz;\n    }\n\n    function rechnen(e) {\n        const ein = e || {};\n        const proTag    = Math.max(0, zahl(ein.proTag, 0));\n        const stunden   = Math.min(24, Math.max(1, zahl(ein.stunden, 24)));\n        const ruhigste  = Math.min(100, Math.max(1, zahl(ein.ruhigste, 40))) \/ 100;\n        const intervall = Math.max(1, zahl(ein.intervall, 60));\n        const k         = Math.max(0.1, zahl(ein.k, 3));\n        const streuung  = Math.max(1, zahl(ein.streuung, 1));\n\n        const intervalleTag = (stunden * 60) \/ intervall;\n        const muMittel = intervalleTag > 0 ? proTag \/ intervalleTag : 0;\n        const muRuhig  = muMittel * ruhigste;<\/p>\n<p>        function fuer(mu) {\n            const sigma = streuung * Math.sqrt(mu);\n            const schwelle = Math.max(0, mu - k * sigma);\n            \/\/ Kleinster Rueckgang, der die Schwelle unterschreitet.\n            const erkennbar = mu > 0 ? Math.min(1, (k * sigma) \/ mu) : 1;\n            return { mu: mu, sigma: sigma, schwelle: schwelle, erkennbar: erkennbar };\n        }<\/p>\n<p>        const mittel = fuer(muMittel);\n        const ruhig  = fuer(muRuhig);<\/p>\n<p>        const proIntervall = phi(-k);\n        const fehlalarmeTag = intervalleTag * proIntervall;<\/p>\n<p>        const hinweise = [];\n        if (muRuhig > 0 && muRuhig < 10) { hinweise.push('zu_wenig'); }\n        if (fehlalarmeTag > 1)           { hinweise.push('zu_laut'); }\n        if (fehlalarmeTag < 0.02 &#038;&#038; fehlalarmeTag > 0) { hinweise.push('sehr_still'); }\n        if (ruhig.erkennbar >= 0.5)      { hinweise.push('blind'); }\n        if (streuung <= 1.0)             { hinweise.push('reine_poisson'); }\n        if (proTag <= 0)                 { hinweise.push('keine_ereignisse'); }\n\n        \/\/ Vergleichstabelle ueber die ueblichen Schwellen\n        const tabelle = [2, 2.5, 3, 3.5, 4].map(function (kk) {\n            const s = streuung * Math.sqrt(muRuhig);\n            return {\n                k: kk,\n                fehlalarmeTag: intervalleTag * phi(-kk),\n                erkennbar: muRuhig > 0 ? Math.min(1, (kk * s) \/ muRuhig) : 1\n            };\n        });<\/p>\n<p>        return {\n            intervalleTag: intervalleTag,\n            mittel: mittel,\n            ruhig: ruhig,\n            proIntervall: proIntervall,\n            fehlalarmeTag: fehlalarmeTag,\n            fehlalarmeMonat: fehlalarmeTag * 30,\n            tabelle: tabelle,\n            hinweise: hinweise\n        };\n    }<\/p>\n<p>    \/\/ --- Pruefpunkt ----------------------------------------------------------\n    window.LW_TEST = window.LW_TEST || {};\n    window.LW_TEST.AN = { phi: phi, erf: erf, rechnen: rechnen };<\/p>\n<p>    \/\/ --- Oberflaeche ---------------------------------------------------------<\/p>\n<p>    const btn = document.getElementById('an-btn');\n    const out = document.getElementById('an-ausgabe');\n    if (!btn || !out) { return; }<\/p>\n<p>    function el(tag, stil, text) {\n        const e = document.createElement(tag);\n        if (stil) { e.setAttribute('style', stil); }\n        if (text !== undefined) { e.textContent = text; }\n        return e;\n    }\n    function wert(id) { const e = document.getElementById(id); return e ? e.value : ''; }\n    function komma(n, stellen) {\n        return Number(n).toFixed(stellen === undefined ? 1 : stellen).replace('.', T.dezimal);\n    }\n    function prozent(anteil) { return komma(anteil * 100, 0) + ' %'; }<\/p>\n<p>    const UEBERSCHRIFT = 'font-family: \\'Nunito Sans\\', sans-serif; font-weight: 700; color: var(--text-primary, #e8e8ee); font-size: 0.92rem; margin: 18px 0 8px;';\n    const ZELLE = 'padding: 5px 12px 5px 0; color: var(--text-secondary, #a0a0b0); font-size: 0.87rem;';\n    const ZELLE_WERT = 'padding: 5px 12px 5px 0; color: var(--text-primary, #e8e8ee); font-size: 0.87rem; font-family: monospace;';<\/p>\n<p>    btn.addEventListener('click', function () {\n        const erg = rechnen({\n            proTag: wert('an-protag'),\n            stunden: wert('an-stunden'),\n            ruhigste: wert('an-ruhigste'),\n            intervall: wert('an-intervall'),\n            k: wert('an-k'),\n            streuung: wert('an-streuung')\n        });<\/p>\n<p>        out.innerHTML = '';<\/p>\n<p>        out.appendChild(el('div', UEBERSCHRIFT, T.h_schwelle));\n        const g = el('div', 'display: grid; grid-template-columns: auto auto auto; gap: 0 18px; align-items: baseline;');\n        function zeile(name, mittel, ruhig) {\n            g.appendChild(el('div', ZELLE, name));\n            g.appendChild(el('div', ZELLE_WERT, mittel));\n            g.appendChild(el('div', ZELLE_WERT, ruhig));\n        }\n        g.appendChild(el('div', ZELLE + ' font-weight: 700;', ''));\n        g.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', T.spalte_mittel));\n        g.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', T.spalte_ruhig));\n        zeile(T.zeile_erwartet, komma(erg.mittel.mu), komma(erg.ruhig.mu));\n        zeile(T.zeile_sigma, komma(erg.mittel.sigma), komma(erg.ruhig.sigma));\n        zeile(T.zeile_schwelle, komma(erg.mittel.schwelle), komma(erg.ruhig.schwelle));\n        zeile(T.zeile_erkennbar, prozent(erg.mittel.erkennbar), prozent(erg.ruhig.erkennbar));\n        out.appendChild(g);<\/p>\n<p>        out.appendChild(el('div', UEBERSCHRIFT, T.h_alarme));\n        const a = el('div', 'display: grid; grid-template-columns: auto auto; gap: 0 18px; align-items: baseline;');\n        a.appendChild(el('div', ZELLE, T.zeile_intervalle));\n        a.appendChild(el('div', ZELLE_WERT, komma(erg.intervalleTag, 0)));\n        a.appendChild(el('div', ZELLE, T.zeile_fehlalarme_tag));\n        a.appendChild(el('div', ZELLE_WERT, komma(erg.fehlalarmeTag, 2)));\n        a.appendChild(el('div', ZELLE, T.zeile_fehlalarme_monat));\n        a.appendChild(el('div', ZELLE_WERT, komma(erg.fehlalarmeMonat, 1)));\n        out.appendChild(a);<\/p>\n<p>        out.appendChild(el('div', UEBERSCHRIFT, T.h_tabelle));\n        const tab = el('div', 'display: grid; grid-template-columns: auto auto auto; gap: 0 18px; align-items: baseline;');\n        tab.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', T.spalte_k));\n        tab.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', T.spalte_fehlalarme));\n        tab.appendChild(el('div', ZELLE + ' font-weight: 700; color: var(--text-primary, #e8e8ee);', T.spalte_erkennbar));\n        erg.tabelle.forEach(function (r) {\n            const laut = r.fehlalarmeTag > 1;\n            const blind = r.erkennbar >= 0.5;\n            tab.appendChild(el('div', ZELLE_WERT, komma(r.k)));\n            tab.appendChild(el('div', ZELLE_WERT + (laut ? ' color: #ffa94d;' : ''), komma(r.fehlalarmeTag, 2)));\n            tab.appendChild(el('div', ZELLE_WERT + (blind ? ' color: #ffa94d;' : ''), prozent(r.erkennbar)));\n        });\n        out.appendChild(tab);<\/p>\n<p>        if (erg.hinweise.length) {\n            out.appendChild(el('div', UEBERSCHRIFT, T.h_hinweise));\n            const liste = el('ul', 'margin: 0 0 0 18px; padding: 0; color: var(--text-secondary, #a0a0b0); font-size: 0.87rem; line-height: 1.65;');\n            erg.hinweise.forEach(function (h) { liste.appendChild(el('li', '', T['hinweis_' + h])); });\n            out.appendChild(liste);\n        }\n    });\n})();\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Turns an event volume into a usable alert threshold: how many false alarms a sigma rule produces per day, and the smallest drop it is able to see at all.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":38,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"template-tool-base.php","meta":{"footnotes":""},"tags":[91258,91294],"class_list":["post-10434","page","type-page","status-publish","hentry","tag-google-analytics-4","tag-monitoring"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>E-Commerce Anomaly Threshold Planner - Lukas Wojcik - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"E-Commerce Anomaly Threshold Planner - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Turns an event volume into a usable alert threshold: how many false alarms a sigma rule produces per day, and the smallest drop it is able to see at all.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-15T12:48:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/ecommerce-anomaly-threshold-planner\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/ecommerce-anomaly-threshold-planner\\\/\",\"name\":\"E-Commerce Anomaly Threshold Planner - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-08-15T12:39:36+00:00\",\"dateModified\":\"2026-08-15T12:48:51+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/ecommerce-anomaly-threshold-planner\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/ecommerce-anomaly-threshold-planner\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/ecommerce-anomaly-threshold-planner\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Toolbox\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/toolbox\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"E-Commerce Anomaly Threshold Planner\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"E-Commerce Anomaly Threshold Planner - Lukas Wojcik - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/","og_locale":"en_US","og_type":"article","og_title":"E-Commerce Anomaly Threshold Planner - Lukas Wojcik - Blog","og_description":"Turns an event volume into a usable alert threshold: how many false alarms a sigma rule produces per day, and the smallest drop it is able to see at all.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/","og_site_name":"Lukas Wojcik - Blog","article_modified_time":"2026-08-15T12:48:51+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/08\/og-default.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/","name":"E-Commerce Anomaly Threshold Planner - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"datePublished":"2026-08-15T12:39:36+00:00","dateModified":"2026-08-15T12:48:51+00:00","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/ecommerce-anomaly-threshold-planner\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Toolbox","item":"https:\/\/www.lukaswojcik.com\/blog\/en\/toolbox\/"},{"@type":"ListItem","position":3,"name":"E-Commerce Anomaly Threshold Planner"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/10434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=10434"}],"version-history":[{"count":1,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/10434\/revisions"}],"predecessor-version":[{"id":10452,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/10434\/revisions\/10452"}],"up":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/pages\/38"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=10434"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=10434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}