# How to Detect Cloud Cost Anomalies: Step by Step

> How to Detect Cloud Cost Anomalies. A practical walkthrough with ZopNight: read-only setup, production excluded by default, reversible at every step.

Source: https://zop.dev/learn/how-to/detect-cloud-cost-anomalies
Published: 2026-07-01 · Author: avinash-gaurav · Tags: zopnight, how-to, learn

---

Configure ZopNight Cost Anomaly Detection across 5 dimensions with z-score and percent deviation. Daily cron at 04:30 UTC catches spikes before they hit your budget.

This is the practical version, the one you can follow in a single sitting. It starts read-only, touches no production resource by default, and every step is reversible, so there is no point at which you are committed to something you cannot undo. Budget about 15 minutes. Before you start you will want: At least 7 days of billing data per account; Notification channels configured (Slack, Teams, GChat, or webhook); A ZopNight account.

## The steps

1. Connect cloud accounts and enable billing sync.
2. Confirm minimum data thresholds.
3. Subscribe to anomaly notifications.
4. Run a manual detection.
5. Review root cause and act.

## Why this is safe to do today

The reason this is a low-stakes change is that nothing here is destructive. Scheduling stops and starts resources; it never deletes them, and your data persists across a stop exactly as it does across a normal reboot. Production is excluded by default, actions run in dependency order, and every state change is logged with what triggered it.

If you want the fuller context behind this task, the [FinOps](https://zop.dev/learn/finops) guide covers where it fits, and the [AWS EC2 scheduling](https://zop.dev/zopnight/aws/ec2) page shows the same loop applied to a specific resource.

## Getting started

Getting started is intentionally low-stakes:

- Connect your cloud provider with a read-only role. Nothing is scheduled or changed at this stage.
- Let ZopNight discover your non-production resources and review exactly what it found, filtered by account, region, and status.
- Create a schedule in your timezone and attach the non-production resources or groups you want it to cover.
- Watch the first cycle run, with Slack, Teams, or Google Chat notifications on every start, stop, and failure, then layer in idle cleanup and guided rightsizing.

Production stays excluded by default throughout, and because discovery and recommendations are read-only, you can prove the value before you enable a single action.

## Frequently asked questions

### Which detection method wins on a single anomaly?

Higher severity wins. ZopNight runs both percent deviation against a 7-day rolling average and z-score, and reports the more severe signal.