> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costoptix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Anomaly Detection

> Statistical cost spike detection that catches unexpected spend before it reaches your invoice.

## How It Works

Cost Optix uses rolling Z-score and adaptive statistical algorithms to establish a baseline of expected spend per service and per account. When actual spend deviates significantly from the expected range, an anomaly is raised at the service level — not just the account total.

This means Cost Optix can identify that, for example, your Azure Blob Storage costs spiked 300% while your overall Azure spend only increased 12% — pinpointing the root cause rather than just flagging a top-level number.

Each detected anomaly includes:

* The service name and cloud provider
* The anomaly date
* Actual spend vs expected spend
* Deviation percentage
* Severity rating
* Detection method used

***

## Anomaly Workflow

Anomalies can be managed directly in the dashboard:

| Status           | Description                         |
| ---------------- | ----------------------------------- |
| `new`            | Freshly detected, unreviewed        |
| `acknowledged`   | Team member has seen it             |
| `investigating`  | Actively being looked into          |
| `resolved`       | Root cause identified and addressed |
| `false_positive` | Flagged as expected behaviour       |

***

## Alerts & Notifications

Anomaly alerts can be delivered to Slack, Microsoft Teams, Discord, or any custom webhook endpoint. Each alert includes the service name, severity, actual vs expected cost, and a direct link to the anomaly in your dashboard.

See [Webhooks](/features/webhooks) for setup instructions.

***

## Tier Limits

| Tier         | Anomaly alerts / month |
| ------------ | ---------------------- |
| Starter      | 3                      |
| Professional | 100                    |
| Business     | Unlimited              |
| Enterprise   | Unlimited              |

<Note>
  The limit applies to anomalies **stored and tracked** per month. Detection still runs across all services — anomalies beyond the limit are surfaced in the dashboard but not retained for historical review.
</Note>