Techniques and structures to facilitate anomaly detection, including receiving performance metric data at a database system having a plurality of data point values, processing the plurality of data point values via an optimized Extreme Studentized Deviate (ESD) test to detect one or more anomalous data point values within the plurality of data point values, including storing a first set of values representing the largest values of the plurality of data point values and a second set of values representing the smallest values of the plurality of data point values, receiving a first of the plurality of data point values, determining whether the first data point value is to be included in the first set of values or the second set of values and determining that the first data point value is not an anomalous data point value upon a determination that the first data point value is not to be inserted into the first set of values or the second set of values and generating an incident alert upon a detection of one or more anomalous data point values within the plurality of data point values.