---
id: 019cb9fd-149b-7d64-9312-bc042987c6ca
name: Order Surge Monitor
kind: Anomaly
cron: 0 0 * * * *
analysis_window: 1h
comparison_periods: [1d, 7d]
---

Detect sudden surges in order volume -- when the order arrival rate spikes well above the expected rate for the time of day.

## Known Tables & Columns

### `curated.kitchen_orders`
- `guid` (varchar, PK) - order identifier
- `store_guid` (varchar) - which store/restaurant
- `items_count` (int) - number of items in the order
- `order_type` (varchar) - DINE_IN, TO_GO, DELIVERY
- `destination` (varchar) - Kitchen, Bar, Window, Expo
- `pos_terminal` (varchar) - POS terminal that created the order (POS-1, POS-2, POS-3, Bar, Drive-Thru)
- `done` (tinyint) - whether the order is complete
- `is_deleted` (tinyint) - soft delete flag
- `create_time` (int, unix timestamp) - when the order was created
- `is_priority` (tinyint) - whether the order is priority

## Analysis Approach

1. Count the number of orders created in the last {AnalysisWindow} from `curated.kitchen_orders`, grouped into 15-minute buckets using `create_time` (`is_deleted=0`).
2. Compute the historical baseline: for the same 15-minute windows {ComparisonPeriods}, calculate the average and standard deviation of order counts.
3. Verify that each baseline window has at least **15 orders**. If the baseline is too sparse, call `emit_no_anomaly` — low-volume periods naturally have high variance.
4. Flag any 15-minute window where the order count exceeds the baseline by more than 3 standard deviations AND is at least **3x** the baseline average.
5. A true order surge should show a **sudden, sharp increase** sustained over **3+ consecutive windows**, not just a single high-count bucket. A single elevated window is NOT an anomaly.
6. Optionally break down by `order_type` or `pos_terminal` to identify the source of the surge (e.g., a rush of delivery orders, or all orders coming from Drive-Thru).
7. Check whether the elevated volume correlates with increased kitchen load (longer prep times, order backlog).

## Severity Guidance

- **Low**: 3x the expected arrival rate sustained for 3+ consecutive windows
- **Medium**: 3x+ the expected arrival rate sustained over 4+ consecutive windows with early signs of kitchen strain
- **High**: 3x+ arrival rate sustained for 15+ minutes with visible impact on kitchen throughput (e.g., growing order backlog, increased prep times)