Cost graph

What the Cost Graph is

The Cost Graph is ZopNight’s reconciled view of your cloud spend. It is built nightly from your billing exports (AWS Cost Explorer, Google BigQuery, Azure Cost Management) and joined to the live resource inventory so that every dollar is attributable to a team and a tag.

It replaces the dashboards your team would otherwise build internally (Cost Flow Sankey, anomaly detection, showback, budgets) and uses the same data behind every finding.

How attribution works

Each cost record is attributed across two dimensions:

• Team: derived from resource ownership (creator from CloudTrail / Audit Logs / Activity Logs, joined to your team mapping).
• Tag: derived from cloud tags or labels, with an optional Smart Tag policy deriving a consistent value for untagged resources.

Shared resources (e.g. a Kubernetes cluster running multiple teams’ workloads) are split equally across owning teams by default. You can override the split per resource group.

All attribution is reconciled to your actual billing export: Cost Explorer, Cost Management, BigQuery; not list price, not estimates. Until a resource’s billing line has landed, its cost is estimated with a rack-rate calculator as a pre-bill fallback; once the bill arrives the figure is reconciled to the actual line item.

Five-dimensional anomaly detection

The Cost Graph runs anomaly detection across five dimensions on a daily cron (04:30 UTC):

• Org-wide: total spend deviates from the 7-day rolling average.
• Cloud account: one account’s spend deviates from its own 7-day average.
• Resource group: a group’s spend deviates from its own average.
• Resource: an individual resource’s daily cost deviates (capped to the top 10 per org per day to avoid noise).
• Team: a team’s allocated spend deviates, with redistribution suppression when costs shift between teams with net change under 20%.

Severity bands are warning (30–150% above baseline), critical (150–500%), and emergency (>500%). Every anomaly carries a root-cause tag; instance resize, new resource, reservation expiry, schedule failure, or unscheduled usage increase. Anomalies are listed on the Anomalies page; notifications are layered on top and configured separately per dimension and severity. See Cost anomalies for the full detail.

The Cost Flow Sankey; every dollar traced provider → account → type → team, with reclaimable spend surfaced inline.

Cost Flow Sankey

The Cost Flow Sankey is a four-column flow diagram that traces every cost dollar through four dimensions. The default layout is:

Provider → Account → Type → Team

Five other layout presets pivot the same data through different dimension chains (e.g. Provider → Account → Service → Team, Provider → Region → Type → Team, Account → Type → Resource → Team). Clicking any node or link narrows the chart and writes a breadcrumb chip so you can drill in and back out one column at a time. See Reports overview for the full layout list and the Savings overlay behaviour.

Dashboard presets

The Cost Graph ships four dashboard presets:

• Executive: top-line spend, month-over-month delta, savings recovered, anomaly count.
• Engineering: by service, by region, by environment, with right-sizing potential.
• FinOps: by team, by tag, with budget health and showback.
• All Widgets: every panel, for power users who want to compose their own.

See Dashboards for the full preset and widget behaviour.

How the Cost Graph powers findings

Every recommendation finding is joined back to the Cost Graph before it lands in your inbox:

1. The rule fires against the inventory (e.g. “Idle EC2 Instance”).
2. The candidate resource’s unit cost is fetched from the billing export.
3. The projected savings is computed against actual, not list.
4. The finding ships with the bill line item it would offset.

This is what we mean by reconciled: every dollar in a finding has a paired dollar in your bill.

Exporting

The Cost Graph can be exported as CSV, JSON, or Parquet from any dashboard. Scheduled exports to S3, GCS, or Azure Blob are available on the Enterprise tier and ship with a manifest file for downstream ETL.