Auto-tune anomaly detection

A method comprising:

• storing training data that comprises a plurality of training instances, each of which comprises a severity-duration pair and a label that indicates whether the severity-duration pair represents an anomaly;
• using one or more machine learning techniques to train a model based on a first subset of the training data;
• identifying a second subset of the training data, wherein each training instance in the second subset includes a positive label that indicates that said each training instance represents an anomaly;
• based on the second subset of the training data, generating, using the model, a plurality of scores, wherein each score corresponds to a different training instance in the second subset;
• identifying a minimum score of the plurality of scores that ensures a particular recall rate relative to training instances in the second subset;
• in response to receiving a particular severity-duration pair, using the model to generate a particular score for the particular severity-duration pair;
• generating a notification of an anomaly if the particular score is greater than the minimum score;
• wherein the method is performed by one or more computing devices.