Techniques for auto-tuning anomaly detection are provided. In one technique, training data is stored that comprises training instances, each of which comprises a severity-duration pair and a label that indicates whether the severity-duration pair represents an anomaly. A model is trained based on a first subset of the training data. A second subset of the training data is identified where each training instance includes a positive label that indicates that that training instance represents an anomaly. Based on the second subset of the training data, the model generates multiple scores, each of which corresponds to a different training instance. A minimum score is identified that ensures a particular recall rate of the model. In response to receiving a particular severity-duration pair, the model generates a particular score for the particular severity-duration pair. A notification of an anomaly is generated if the particular score is greater than the minimum score.