# Cost graph

> The Cost Graph is ZopNight's reconciled, multi-dimensional view of cloud spend; every dollar attributed, every finding verified against the bill.

Source: https://zop.dev/docs/zopnight/concepts/cost-graph

---

## What the Cost Graph is

The Cost Graph is ZopNight's reconciled view of your cloud spend. It is built nightly from your billing exports (AWS Cost Explorer, Google BigQuery, Azure Cost Management) and joined to the live resource inventory so that **every dollar is attributable** to a team and a tag.

It replaces the dashboards your team would otherwise build internally (Cost Flow Sankey, anomaly detection, showback, budgets) and uses the same data behind every finding.

## How attribution works

Each cost record is attributed across two dimensions:

- **Team**: derived from resource ownership (creator from CloudTrail / Audit Logs / Activity Logs, joined to your team mapping).
- **Tag**: derived from cloud tags or labels, with an optional [Smart Tag](https://zop.dev/docs/zopnight/concepts/smart-tags) policy deriving a consistent value for untagged resources.

Shared resources (e.g. a Kubernetes cluster running multiple teams' workloads) are split equally across owning teams by default. You can override the split per resource group.

**All attribution is reconciled to your actual billing export**: Cost Explorer, Cost Management, BigQuery; not list price, not estimates. Until a resource's billing line has landed, its cost is estimated with a rack-rate calculator as a pre-bill fallback; once the bill arrives the figure is reconciled to the actual line item.

**Note**

Billing exports can lag by a day or more, so figures for the most recent days may adjust as the provider finalizes the bill. Spend that can't yet be attributed to a team or tag is shown as unattributed rather than dropped.

## Five-dimensional anomaly detection

The Cost Graph runs anomaly detection across five dimensions on a daily cron (04:30 UTC):

- **Org-wide**: total spend deviates from the 7-day rolling average.
- **Cloud account**: one account's spend deviates from its own 7-day average.
- **Resource group**: a group's spend deviates from its own average.
- **Resource**: an individual resource's daily cost deviates (capped to the top 10 per org per day to avoid noise).
- **Team**: a team's allocated spend deviates, with redistribution suppression when costs shift between teams with net change under 20%.

Severity bands are warning (30–150% above baseline), critical (150–500%), and emergency (>500%). Every anomaly carries a root-cause tag; instance resize, new resource, reservation expiry, schedule failure, or unscheduled usage increase. Anomalies are listed on the **Anomalies** page; notifications are layered on top and configured separately per dimension and severity. See [Cost anomalies](https://zop.dev/docs/zopnight/reports/anomalies) for the full detail.

![Cost Flow Sankey diagram tracing spend from provider to account to resource type to team, with a top cost driver callout](https://storage.googleapis.com/zopdev-blog-resources/1/files/originals/20260707/18740c85-9ef0-47b2-b001-61a2411bce63-costflow.png)

*The Cost Flow Sankey; every dollar traced provider → account → type → team, with reclaimable spend surfaced inline.*

## Cost Flow Sankey

The Cost Flow Sankey is a four-column flow diagram that traces every cost dollar through four dimensions. The default layout is:

```
Provider → Account → Type → Team
```

Five other layout presets pivot the same data through different dimension chains (e.g. Provider → Account → Service → Team, Provider → Region → Type → Team, Account → Type → Resource → Team). Clicking any node or link narrows the chart and writes a breadcrumb chip so you can drill in and back out one column at a time. See [Reports overview](https://zop.dev/docs/zopnight/reports/overview) for the full layout list and the Savings overlay behaviour.

## Dashboard presets

The Cost Graph ships four dashboard presets:

- **Executive**: top-line spend, month-over-month delta, savings recovered, anomaly count.
- **Engineering**: by service, by region, by environment, with right-sizing potential.
- **FinOps**: by team, by tag, with budget health and showback.
- **All Widgets**: every panel, for power users who want to compose their own.

See [Dashboards](https://zop.dev/docs/zopnight/concepts/dashboards) for the full preset and widget behaviour.

## How the Cost Graph powers findings

Every recommendation finding is joined back to the Cost Graph before it lands in your inbox:

1. The rule fires against the inventory (e.g. "Idle EC2 Instance").
2. The candidate resource's unit cost is fetched from the billing export.
3. The projected savings is computed against actual, not list.
4. The finding ships with the bill line item it would offset.

This is what we mean by **reconciled**: every dollar in a finding has a paired dollar in your bill.

## Exporting

The Cost Graph can be exported as CSV, JSON, or Parquet from any dashboard. Scheduled exports to S3, GCS, or Azure Blob are available on the Enterprise tier and ship with a manifest file for downstream ETL.