Anomaly Detector Processor - Can detect an anomaly of a metric "going down"?

[canob]

Hi,

I have configured Data Prepper Anomaly Detector Processor with metrics from DNS queries, and I want to know if Data Prepper Anomaly Detector Processor can detect not only an anomaly of a metric "going up" (like the one in red), but also an anomaly of a metric "going down" (like the red square):

Is that possible? Maybe with other algorithm, and not with random cut forest?

Thanks in advance for your answers.