In Elastic's version 6.5 of their machine learning anomaly scoring, significant changes were introduced to improve the way anomalies are assessed and reported. The normalization of partitions now considers a maximum normalized score per partition, offering a broader range of scores and making it easier to identify significant anomalies across different partitions. Previously, normalized scores were influenced by more severe anomalies in other partitions, leading to lower scores for some significant events. Additionally, the introduction of multi-bucket analysis allows for the detection of anomalies that occur over multiple time buckets, which were previously difficult to identify. This change is highlighted by a new "cross" symbol in the user interface, indicating a multi-bucket anomaly, and the addition of a multi_bucket_impact field in the data. These enhancements are intended to provide more accurate and actionable anomaly detection and necessitate a review of alerting logic for users utilizing Elastic machine learning in their workflows.