# Argos: Agentic Time-Series Anomaly Detection with Autonomous Rule Generation via Large Language Models

arXiv: https://arxiv.org/abs/2501.14170 · HTML: https://mlsanity.com/paper/2501.14170/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 21 of its 75 references that are in the map.
- First posted on arXiv 24 Jan 2025.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 21 of 21)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [The Llama 3 Herd of Models](https://mlsanity.com/paper/2407.21783/) (2024)
- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [Self-Consistency Improves Chain of Thought Reasoning in Language Models](https://mlsanity.com/paper/2203.11171/) (2022)
- [GPT-4o System Card](https://mlsanity.com/paper/2410.21276/) (2024)
- [Code Llama: Open Foundation Models for Code](https://mlsanity.com/paper/2308.12950/) (2023)
- [Time-LLM: Time Series Forecasting by Reprogramming Large Language Models](https://mlsanity.com/paper/2310.01728/) (2023)
- [Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy](https://mlsanity.com/paper/2110.02642/) (2021)
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](https://mlsanity.com/paper/2201.07284/) (2022)
- [Investigating the Limitations of Transformers with Simple Arithmetic Tasks](https://mlsanity.com/paper/2102.13019/) (2021)
- [The Good, The Bad, and The Greedy: Evaluation of LLMs Should Not Ignore Non-Determinism](https://mlsanity.com/paper/2407.10457/) (2024)
- [Large language models can be zero-shot anomaly detectors for time series?](https://mlsanity.com/paper/2405.14755/) (2024)
- [Large Language Models can Deliver Accurate and Interpretable Time Series Anomaly Detection](https://mlsanity.com/paper/2405.15370/) (2024)
- [TimeSeriesBench: An Industrial-Grade Benchmark for Time Series Anomaly Detection Models](https://mlsanity.com/paper/2402.10802/) (2024)
- [Can LLMs Serve As Time Series Anomaly Detectors?](https://mlsanity.com/paper/2408.03475/) (2024)
- [Constructing Large-Scale Real-World Benchmark Datasets for AIOps](https://mlsanity.com/paper/2208.03938/) (2022)
- [A Survey of AIOps for Failure Management in the Era of Large Language Models](https://mlsanity.com/paper/2406.11213/) (2024)
- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [Cloud Atlas: Efficient Fault Localization for Cloud Systems using Language Models and Causal Insight](https://mlsanity.com/paper/2407.08694/) (2024)
- [AIOps Solutions for Incident Management: Technical Guidelines and A Comprehensive Literature Review](https://mlsanity.com/paper/2404.01363/) (2024)

## Built on by (most cited first, 19 of 19)

- [KVFlow: Efficient Prefix Caching for Accelerating LLM-Based Multi-Agent Workflows](https://mlsanity.com/paper/2507.07400/) (2025)
- [A Survey of Reasoning and Agentic Systems in Time Series with Large Language Models](https://mlsanity.com/paper/2509.11575/) (2025)
- [AD-AGENT: A Multi-agent Framework for End-to-end Anomaly Detection](https://mlsanity.com/paper/2505.12594/) (2025)
- [Safe, Untrusted, "Proof-Carrying" AI Agents: toward the agentic lakehouse](https://mlsanity.com/paper/2510.09567/) (2025)
- [AnomaMind: Agentic Time Series Anomaly Detection with Tool-Augmented Reasoning](https://mlsanity.com/paper/2602.13807/) (2026)
- [Fortifying the Agentic Web: A Unified Zero-Trust Architecture Against Logic-layer Threats](https://mlsanity.com/paper/2508.12259/) (2025)
- [LLM-Assisted Logic Rule Learning: Scaling Human Expertise for Time Series Anomaly Detection](https://mlsanity.com/paper/2601.19255/) (2026)
- [Visual Reasoning over Time Series via Multi-Agent System](https://mlsanity.com/paper/2602.03026/) (2026)
- [From paper to benchmark: agentic, framework-based reproduction of under-specified methods in machine health intelligence](https://mlsanity.com/paper/2605.28371/) (2026)
- [LLM Agents for Time-Series: A Survey](https://mlsanity.com/paper/2608.26226/) (2026)
- [From Time Series Analysis to Question Answering: A Survey in the LLM Era](https://mlsanity.com/paper/2506.11512/) (2025)
- [Exploring LLM-based Frameworks for Fault Diagnosis](https://mlsanity.com/paper/2509.23113/) (2025)
- [Physics-Informed Large Language Models for HVAC Anomaly Detection with Autonomous Rule Generation](https://mlsanity.com/paper/2510.17146/) (2025)
- [Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework](https://mlsanity.com/paper/2601.17817/) (2026)
- [Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage](https://mlsanity.com/paper/2603.23966/) (2026)
- [Plan First, Judge Later, Run Better: A DMAIC-Inspired Agentic System for Industrial Anomaly Detection](https://mlsanity.com/paper/2606.04599/) (2026)
- [Constructing Dynamic Master Logic Models as Knowledge Graphs for Complex System Diagnostics Using Retrieval-Augmented Large Language Models](https://mlsanity.com/paper/2608.12304/) (2026)
- [Memory in Deep Time-Series Models](https://mlsanity.com/paper/2609.06006/) (2026)
- [Agentic RCA for Internet-Scale Services Using Constrained Creativity](https://mlsanity.com/paper/2610.08622/) (2026)

## Abstract (arXiv)

Observability in cloud infrastructure is critical for service providers, driving the widespread adoption of anomaly detection systems for monitoring metrics. However, existing systems often struggle to simultaneously achieve explainability, reproducibility, and autonomy, which are three indispensable properties for production use. We introduce Argos, an agentic system for detecting time-series anomalies in cloud infrastructure by leveraging large language models (LLMs). Argos proposes to use explainable and reproducible anomaly rules as intermediate representation and employs LLMs to autonomously generate such rules. The system will efficiently train error-free and accuracy-guaranteed anomaly rules through multiple collaborative agents and deploy the trained rules for low-cost online anomaly detection. Through evaluation results, we demonstrate that Argos outperforms state-of-the-art methods, increasing F1 scores by up to 9.5% and 28.3% on public anomaly detection datasets and an internal dataset collected from Microsoft, respectively.