> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usestealth.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# How detection works

> What normal means, how Stealth separates your problems from market moves, and what it cannot see.

Stealth does not use fixed targets. It compares each ad unit and each client with its own history at the same hour and weekday, and with how the rest of your portfolio moved at the same time. This page explains those two comparisons, the checks that run them and the limits of what Stealth can see.

## How it works

### The hourly check

Every hour, around 20 minutes past the hour, Stealth reads new data from each monitored network. Google Ad Manager data for the most recent hours is still being completed, so each check evaluates the hour that **started 2 hours earlier**, together with the hours before it (up to 8 hours). A network whose data for that hour has not arrived sits the check out and is evaluated in the next one.

Once a day, after Google Ad Manager closes the previous day (from 06:00 in the network's time zone), Stealth also runs the **daily rules** on yesterday.

### Normal

* **Hourly normal**: the median of the same hour, on the same weekday, in the 4 previous weeks. Stealth needs at least 3 of those 4 weeks. Without them, there is no normal for that hour and nothing is evaluated.
* **Daily normal**: for revenue per request, the same weekdays in the 3 previous weeks. For the trend, the 14 days before the last 7.

Using the same hour and weekday means a quiet Sunday night is compared with other Sunday nights, not with Monday morning.

### The market adjustment

When traffic or prices fall across the whole portfolio, for example on a holiday or when advertisers cut budgets, that is not a problem of one ad unit. Before calling something a drop, Stealth divides each ratio (real over normal) by the same ratio of the **median client** of your organization. A client that fell 30% while the median client fell 25% did not, in practice, fall beyond the market.

The adjustment needs at least 5 clients with enough volume. With fewer, Stealth compares with normal directly.

### Minimum volume

Small numbers swing a lot, so Stealth only evaluates what has enough volume:

| What | Minimum |
| - | - |
| Ad unit, hourly rules | 100 requests in the hour's normal |
| Client, hourly rules | 1,000 requests in the hour's normal |
| Client, daily rules | R\$ 50 per day of normal revenue |
| Any incident | an estimated loss of at least R\$ 10 per day |

### From drop to incident

When a rule fires for long enough (see [Alert kinds](https://docs.usestealth.dev/en/detection/alert-kinds.md)), Stealth estimates how much revenue is being lost per day, gives the drop a [severity](https://docs.usestealth.dev/en/detection/severity.md) and opens an incident. The [incident lifecycle](https://docs.usestealth.dev/en/detection/incident-lifecycle.md) explains how it gets worse and how it is resolved. Alerts then follow your [rules and preferences](https://docs.usestealth.dev/en/alerts/overview.md).

### What Stealth cannot see

> [!WARNING]
>
> Stealth sees what Google Ad Manager reports. Read these limits before relying on the absence of an alert.

* **Requests and revenue per hour are not reported directly.** Google Ad Manager's hourly report has impressions and unfilled impressions. Stealth counts hourly requests as the sum of the two and estimates hourly revenue as impressions times the eCPM of the previous 7 days. Daily numbers use the real daily revenue.
* **There is a delay.** Each hour is evaluated about 2 hours after it starts, and some rules need 2 or 3 hours in a row. Daily rules run on yesterday's data.
* **Small ad units and clients are not evaluated** below the minimum volumes above.
* **A drop of the whole market is not an incident.** If every client falls the same way, the [Panel](https://docs.usestealth.dev/en/screens/panel.md) shows it, but no incident opens.
* **Increases are not alerts.** Stealth only looks for drops.
* **Ad units without enough history**, such as new ones, have no normal for 3 weeks.
* **Missing data is not a drop.** An hour with no data from a whole network is treated as a gap, not as zero. If Stealth cannot read a network's Google Ad Manager reports for more than 3 hours, every member receives a **No recent data** notice instead.
* **New ad units** count under the network itself until the next daily catalog links them to their client.
* **Networks without partners** (no Multiple Customer Management) have a single client: the network itself.
* **Clients and categories you turned off** do not open incidents.
* **Thresholds are in reais.** For a network in another currency, Stealth converts amounts with a fixed factor of 0.2 (for example, R\$ 50 becomes 10 dollars or euros), not with the day's exchange rate.

## FAQ

> [accordion] Why did a drop I saw not become an incident?
>
> The usual reasons are: it lasted less than the hours the rule needs, it followed the market, the ad unit or client is below the minimum volume, it had no normal yet, or the estimated loss was below R\$ 10 per day.

> [accordion] Does Stealth learn from my feedback?
>
> No. The rules and thresholds are the same for every organization and are described on these pages. You control what becomes an alert with the [organization rules and exceptions](https://docs.usestealth.dev/en/alerts/overview.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.