n8n KPI Anomaly Detection: Postgres + Slack + Gmail + Claude

Detect KPI anomalies automatically—then investigate with Claude and notify the right owners in Slack, GitHub, and Gmail

This n8n KPI Anomaly Detection workflow pulls daily KPIs from Postgres, builds robust statistical baselines, detects unusual metric movements each morning, and automatically investigates confirmed anomalies using an OpenRouter (Claude) agent with supporting evidence from Postgres and GitHub. Alerts are routed by severity to Slack, GitHub Issues (for critical), and Gmail—plus a weekly precision report.

What this workflow does

• Nightly KPI collection (01:00): Reads enabled metric definitions from Postgres, executes each metric’s SQL, and stores yesterday’s observations.
• Robust baseline recomputation: Rebuilds per-metric baselines in Postgres using a 28-day median and MAD, with day-of-week medians. Tracks baseline coverage and warns in Slack if history is insufficient.
• Morning anomaly scoring (07:00): Pulls yesterday’s KPI values joined with baseline stats and metric metadata from Postgres.
• Robust z-score anomaly detection: Scores each KPI move into a robust z-score, applies direction and minimum-change rules, filters anomalies, and suppresses duplicates using recent open incidents and a per-run incident cap.
• Automated investigation with Claude: For each admitted anomaly, creates an incident record in Postgres, then queries Postgres and GitHub via an OpenRouter (Claude) agent for supporting evidence; explanations failing an evidence/consistency check are discarded.
• Severity-based routing: Updates the incident with the investigation outcome and notifies owners via Slack; for critical alerts, also files a GitHub Issue and emails the metric owner for acknowledgement.

Use cases

• SaaS teams monitoring conversion rate, retention, and latency KPIs across daily shifts
• Automation engineers needing trustworthy KPI anomaly detection with duplicate suppression
• Operators who want Slack-first alerts plus deeper investigation context via Claude

Technical details

• Data source: Postgres (metric definitions, observations, baselines, incident records)
• AI investigator: OpenRouter (Claude) agent with Postgres + GitHub evidence queries
• Notifications: Slack (warnings + anomaly alerts), GitHub Issues (critical), Gmail (owner acknowledgement)
• Workflow nodes: if, set, code, gmail, merge, slack