Anomaly detection for vault / consul

Anyone working on or doing log anomaly detection with vault and or consul?