You'll see the sudden increase in traffic to port event fire once an anomaly is detected. If you then look at the details of the event you'll see output that looks something like this:
Traffic anomaly to host x.x.x.x at port 80. Flow/Session count this hour is 9164, Mean is 0, Variance is 0.
