I don't think of anomaly detection as being the end, it's triage. It shouldn't do more than "I found something that doesn't follow the normal patterns, let me p

I don't think of anomaly detection as being the end, it's triage. It shouldn't do more than "I found something that doesn't follow the normal patterns, let me page someone to take a look." And you need to use it strategically, it's not for use everywhere. Like anything, it's a tool and it really depends on how you use it.