# Custom action for Anomaly Detection

**URL:** <https://forum.opensearch.org/t/custom-action-for-anomaly-detection/5998>\
**Category:** Machine Learning\
**Created:** [May 21, 2021, 7:02am UTC](https://forum.opensearch.org/t/custom-action-for-anomaly-detection/5998 "2021-05-21T07:02:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![insu0929](https://avatars.discourse-cdn.com/v4/letter/i/839c29/32.png) [@insu0929](https://forum.opensearch.org/u/insu0929)\
**Post date:** [May 21, 2021, 7:02am UTC](https://forum.opensearch.org/t/custom-action-for-anomaly-detection/5998/1 "2021-05-21T07:02:47Z")

</div>

Hi I’m new to Open Distro and currently utilizing Anomaly Detection with metricbeats index.  
The system fields that I’m using is system.cpu.total.pct, using features with aggregation for average and max.

The Anomaly Detection works just fine, but I’m wondering if there’s anyway I can figure out the process name that’s causing when the detector detects anomalies.

Thanks.

---

<div class="post-metadata">

**Author:** ![ylwu](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@ylwu](https://forum.opensearch.org/u/ylwu)\
**Post date:** [June 3, 2021, 11:46pm UTC](https://forum.opensearch.org/t/custom-action-for-anomaly-detection/5998/2 "2021-06-03T23:46:43Z")

</div>

We don’t start separate process for anomaly detection.