The Anomaly Detection module watches the metrics and dimensions you care about in your GA4 data and flags anything that falls outside what is historically normal. A broken tag, a misconfigured campaign, a channel that quietly stopped tracking: you see it the next day, not at the quarterly review.
It runs natively in your BigQuery export as part of GA4Dataform Premium. No extraction, no external tooling.
Analytics data goes off for many reasons: an app update, a misconfigured campaign, a tracking change, content going viral. Depending on how the data is segmented, an issue can stay invisible for weeks and surface in the worst meeting. Sometimes a metric drops for real reasons too – either way, you want to know on day one, not week three.
Anomaly Detection compares each day’s numbers against what is normal for that series, so you set the agenda instead of explaining a chart you have never seen before.
The module trains a BigQuery ML time-series model (ARIMA) on your own history, 90 days by default, and scores new data against it every day. Each series learns its own expected range, so a broken segment can’t hide inside a healthy total and a normal seasonal spike doesn’t set off alarms.
ga4_events monitors daily event counts by event name, catching things like a broken tag dropping purchase events. ga4_sessions monitors session counts by channel grouping, so a sudden drop in organic or an unexpected spike in paid is surfaced immediately. Enable the module and both run with your daily refresh, no extra configuration.
Every case writes to a single output table, anomaly_detection_report, with the metric value, the expected bounds, and an is_anomaly flag per series and day. Training history is included for context, so one query gives you the baseline and the deviation side by side.
A ready-made Looker Studio template sits on top of the report table: pick a case, pick a time series, and see the training window, the expected band, and the flagged points in one view. Useful for the morning check, and for showing exactly what happened when someone asks.
A case is a set of rules for where to look: which table, which metric, which dimensions, which thresholds. The defaults run on GA4Dataform output tables, but a case can point at any BigQuery table. Adjust training windows, choose a rolling or frozen reference period, and tune thresholds when your traffic doesn’t fit the defaults.
Training, detection, and reporting all run as part of your Dataform pipeline, inside your own Google Cloud project. No extraction, no external tooling, nothing new with access to your data. Enable it in the module config and it runs with every full refresh.
An anomaly is a deviation from what is normal; an alert is a decision that something needs action. The module keeps the two apart: it produces anomaly candidates, and you define the alert rules on top – persists for two days, touches revenue, hits a critical channel. That keeps the noise down and the trust up.
Anomaly detection has more knobs than most modules, so we offer Premium buyers a free hour of consulting to set it up: enable the module, size the thresholds to your traffic, and read the first results together. The documentation covers the rest, from overview to full reference.
A GA4Dataform Premium installation. The module ships with Premium: set enabled to true in the module config and it runs with your daily pipeline. Models train on your own history, 90 days by default, so a property needs roughly two months of data before detection is reliable.
Two pre-configured cases: ga4_events tracks daily event counts by event name, and ga4_sessions tracks session counts by channel grouping. Both write their results to the anomaly_detection_report table.
Yes. Cases can point at any BigQuery table, not just GA4Dataform outputs. You define the metric, the dimensions, the training window, and the thresholds per case.
Each time series trains a BigQuery ML ARIMA model on its own history. New data is scored daily against the model’s expected bounds, and values outside them are flagged with is_anomaly. Series that are too thin to score reliably are marked as weak, so you know which signals to trust.
Detection and alerting are deliberately separate. The module produces anomaly candidates in one table; you build alert rules on top with the tooling you already use, and you can add Dataform assertions that fail the run when a critical series deviates.
Yes. Premium buyers get a free hour of consulting to set up the anomaly detection module. Talk to a human and we walk through it with you.
