Skip to main content

​
How detection works

CostOptix builds a baseline for every service separately, then flags a day that departs from that service’s own history. It works per service, not on the account total, so a 300% jump in one storage service is caught even when the whole account only rose 12%. Detection runs on cloud accounts, Kubernetes clusters (per namespace and workload) and hosts.

​
Baselines that ignore past spikes

Baselines use the median and the median absolute deviation, not the mean and standard deviation. One expensive day pulls a mean up far enough that the next real anomaly looks normal. The median barely moves, so past spikes do not hide future ones.

​
The method depends on history

​
Edge cases

  • Services averaging under $1 a day are skipped. Free-tier overflow and rounding would otherwise produce absurd percentages.
  • A service going from $0 to real spend is an emergence. It is reported with the dollar amount and no percentage, which is what you actually need to know.
  • A perfectly flat service falls back to a 20% change rule, so one big jump on a stable line is never missed.

​
Important anomalies

Not every statistical blip is worth an alert. An anomaly is important, and can send an alert, when it is one of these:
  • A material spike. Spend rose by at least $20 or 2% of the account’s median daily spend, whichever is larger.
  • A stopped service. A sizeable service fell by that much and is now at 10% or less of its usual cost.
Two more rules cut noise:
  • A recovery is not a spike. A rise back into the service’s normal range over the last 28 days is ignored.
  • One alert per run. A lasting change alerts once, not every day. It alerts again only if the impact grows by 50% or more, and the run ends after two normal days.
Severity comes from impact, as a share of the account’s median daily spend: The Anomalies page shows Important anomalies by default. Switch to All to see everything the detector found.

​
What each anomaly shows

  • Service and provider
  • Date
  • Actual spend against expected spend
  • Deviation
  • Severity
  • Whether spend rose or fell
Click an anomaly to open its resource breakdown: every resource that changed on that day, ranked by dollar impact, with filters and export.

​
Root cause analysis

From the breakdown, run root cause analysis. It works in two steps:
  1. Numbers first. CostOptix computes which resources changed on that date and how (new, scaled up, scaled down, removed), ranked by confidence and dollar impact. This step uses no AI quota.
  2. Then the explanation. Those exact results go to the AI assistant, which explains what happened and what to do in plain language. This uses one AI question.
You can then open the chat with the anomaly already loaded and ask follow-up questions. See AI Insights.
On AWS and Azure, resource-level detail is only available for the last 14 days because of provider API limits. Older anomalies are analysed at service level and say so. GCP has no such limit.

​
Workflow

Resolving an anomaly also clears it from the Anomalies tab of Recommendations.

​
Alerts

Important anomalies are sent to any webhook subscribed to Cost Anomaly Detected: Slack, Microsoft Teams, Discord or your own endpoint. Each alert names the service, the impact, its share of daily spend, the severity, and the top resources behind it. See Webhooks.

​
Plan limits

The limit applies to anomalies stored for history. Detection still runs on every service, and anomalies beyond the limit are still shown on the dashboard.