Creating Anomaly Detection algorithm

Question

I am interested in the time series anomaly detection for security log files. I found cases similar to mine at the following link: Time Series Anomaly Detection with Python. At the end of the page one of the experts (Mr. Keiven) said: "... take a rolling X period moving average, subtract current metric value from the moving average." I was asked about some step by step details about his algorithm: this is the whole story. If you have understood the approach, I will appreciate any explanations.