LLM-Augmented Anomaly Detection with Isolation Forest and SHAP in Snowflake

In modern data-driven systems, detecting anomalies in server logs is vital for ensuring operational stability and security. This work presents a fully cloud-native anomaly detection and explainability pipeline built entirely within the Snowflake data platform. Starting from publicly available server log datasets, we preprocess and ingest the data using staged bulk insertions for efficient loading. Leveraging Snowflake's native Python execution, we engineer features and train an Isolation Forest model for unsupervised anomaly detection, accurately flagging abnormal server behaviors. SHAP (SHapley Additive exPlanations) values interpret these anomalies by identifying key contributing features and clarifying whether the anomaly is driven by unusually high or low values. Finally, Snowflake Cortex's LLM capabilities are employed to auto-generate concise, human-readable insights, enabling seamless integration into analytical dashboards. This pipeline demonstrates a scalable, explainable, and fully SQL-integrated approach to anomaly detection—without relying on any external compute infrastructure.