The technology is generally directed to generating an alert based on a direction and depth of a detected anomaly. The direction of the anomaly may provide an indication as to whether the anomaly is broadening or normalizing, and the depth of the anomaly may provide an indication of the magnitude of the direction as compared to the detected anomaly. The direction may be positive, indicating that the anomaly is normalizing or moving towards an expected value, or negative, indicating that the anomaly is broadening or moving further from the expected value. Based on the determined direction and depth, a trend of the anomaly may be determined. A normalizing trend may indicate that the anomaly is likely to normalize and, therefore, an alert is not necessary. A broadening trend may indicate that the anomaly is likely to broaden and, therefore, an alert should be generated.