So, let's see: We have a server farm and it is working along. We want to know right along, in real time, if it is sick or healthy. So, we do some monitoring.

So, let's see: We have a server farm and it is working along. We want to know right along, in real time, if it is sick or healthy. So, we do some monitoring. There are two kinds: (1) The first kind looks for problems never seen before. Here we get to use data of two kinds, (i) when the system was healthy and (ii) when the system was sick and we detected the problem, understood it, found out why, and tried to prevent that problem in the future. (2) The second kind looks for problems never seen before, that is, zero-day problems. Here we have no data on the problems but likely do have a lot of data on when the system was healthy or at least seemed to be, not just on the day of the data collection but also later. In both cases we have two ways to be wrong: (A) Say that the system is sick when it is healthy -- a false alarm. (B) Say that the system is healthy when it is sick -- a missed detection. So, from (A) and (B), we get two rates and want both to be low. We can get data on many variables at high data rates. Now, what do we do? Okay, it's a problem in, say, data analysis, data science, statistics, AI/ML, right? Hmm .... What do we do? Uh, be warned: If the false alarm rate is too high, then the monitoring will be ignored.