Anomalies

Monitor vehicles for towing and tampering events. Anomalies creates alert cases when unusual behavior is detected, helping you investigate and respond to potential security incidents.

For feature requirements, configuration options, and API integration, see Anomalies Feature Documentation.

Opening Anomalies

Navigate to Monitoring → Anomalies.

The page displays all detected anomaly cases in a table format.

Understanding the Table

The Anomalies table shows detected cases with the following columns:

Column	Description
Flagged	Pin icon to mark cases for follow-up
Anomaly ID	Unique case identifier
Created At	Detection date and time
Vehicle ID	Internal vehicle identifier
License Plate	Vehicle registration number
Status	Current case status (see Status Types)
Anomalies	Detection type: Towing Detected or Tampering Detected

Select Configure Table Columns (⚙️) to customize which columns appear and their order.

Status Types

Each anomaly case displays one of four status types:

Status	Description
Observing	The system has detected potentially suspicious activity and is actively monitoring the vehicle.
OK	The monitoring period has ended with no signs of malicious activity. The telematics unit is functioning normally.
Anomaly Detected	The system has detected potentially malicious activity and the telematics device is not responding. This status requires your evaluation.
Error	The detection process could not complete successfully. Check the vehicle status through Inspect and Events.

Navigating the Table

Sort columns, paginate results, and configure visible columns using the standard table controls. See User Interface for details.

Use the search bar to find cases by vehicle ID, license plate, or anomaly ID.

Filtering Anomalies

Select Filter to narrow displayed cases.

Available filters:

• Vehicle ID: Specific vehicles
• License Plate: Registration number
• Anomaly Type: Detection category
• Status: Active or resolved cases
• Date Range: Time period

Select Reset to clear all filters.

Using Presets

Save frequently used filter combinations as presets.

To create a preset:

1. Configure filters
2. Select Save as Preset
3. Enter a name
4. Confirm

To use a preset: Select it from the Presets dropdown

To manage presets: Update or delete from the dropdown menu

Viewing Anomaly Details

Select any row to open the Anomaly Details panel on the right.

The panel displays:

Events During Anomaly:

• Map showing vehicle location during the anomaly period
• Chronological event list with timestamps and telemetry data

Anomaly Metrics:

• Anomaly ID
• Creation timestamp
• Vehicle ID and license plate
• Current status
• Anomaly type

Last Anomalies:

• Previous cases for this vehicle
• Historical patterns

Managing Cases

Each row includes action buttons:

Button	Action
Show Events	Open the events list for this vehicle
Inspect Vehicle	Open the vehicle detail view
More Actions (⋯)	Access case management menu

More Actions Menu

Resolve Case

Mark the case as resolved. Status changes to OK and the case remains in history but is excluded from active case views when filtered.

Ignore Vehicle

Exclude this vehicle from future anomaly detection. The vehicle moves to the Ignored Vehicles list and no new cases are created for it.

Common use cases:

• Test or demo vehicles
• Vehicles with known behavior patterns that trigger false alerts
• Fleet vehicles with legitimate unusual operational patterns

Remark

Add notes to the case. Use remarks to document investigation findings, actions taken, or context for team members.

Show Vehicle History

View all anomaly cases for this vehicle across all time periods.

Viewing Ignored Vehicles

Select Ignored Vehicles to view the list of vehicles excluded from detection.

This list shows vehicles you have deliberately removed from monitoring because they generate false alerts or have known unusual behavior patterns.

Anomaly Types

The system detects two categories of unusual behavior:

Towing Detected: Vehicle movement detected without an active rental. This may indicate theft, unauthorized relocation, or legitimate maintenance activities.

Tampering Detected: Physical interference with the telematics unit detected. This may indicate vandalism, theft attempts, or hardware connection issues.

For details on these event types, see Events Reference.

Investigation Workflow

When a new anomaly appears:

1. Review the event timeline: Check the map and event list to understand what triggered detection
2. Verify rental status: Confirm whether movement was authorized
3. Check vehicle history: Look for recurring patterns with this vehicle
4. Add remarks: Document your findings
5. Take action: Resolve the case, ignore the vehicle, or escalate to security

Cross-reference with:

• Trips: Review complete movement history
• Raw Data: Examine detailed telemetry
• Vehicle access logs: Check for unauthorized entry

Understanding False Positives

Some legitimate activities may trigger anomaly detection:

• Maintenance or service appointments requiring towing
• Dealer relocations or fleet reorganization
• Test vehicles with intentional unusual patterns
• Hardware issues causing connectivity interruptions
• Areas with poor GPS signal causing location anomalies

When you identify consistent false positives, use Ignore Vehicle to exclude them from future detection. Review your ignored vehicles list periodically to ensure exclusions remain appropriate.

Need Help?

Contact INVERS Support for assistance with anomaly detection, investigation support, or security incident response.