Embodiments of the present technology provide systems, methods, and computer storage media for facilitating anomaly detection. In some embodiments, a prediction model is generated using a training data set. The prediction model is used to predict an expected value for a latest (current) timestamp, which is used to determine that the incoming observed data value is an anomaly. Based on the incoming observed data value determined to be the anomaly or not, a corrected data value is generated to be included in the training data set. Thereafter, the training data set having the corrected data value is used to update the prediction model for use in determining whether a subsequent observed data value is anomalous. Such a process may be performed in an iterative manner to maintain optimized training data and prediction model.