Outcome
By the end of this lesson, you will be able to explain why a cost shift between teams doesn’t fire an anomaly, explain why the 20% threshold is fixed, and recognize when suppression might mask a real issue.
| Prerequisites | M2.10.L1 - L4 |
| Time | 9 minutes |
1. Concept
When one team’s spending goes up because another team’s went down by the same amount, nothing has actually happened. A resource moved hands.
The system notices that the two cancel out and stays quiet about both, rather than sending two alerts about one non-event.
THE INSIGHT: Cost shift between teams ≠ cost event It's redistribution Total stays the same Two teams' alerts would be noise
SUPPRESSION: Detect: net dollar change summed across all teams in the org If |net change| < 20% of the largest single-team move: drop every team-level anomaly for that org that day Org-level and resource-level still fireThe pattern reduces noise without losing signal.
How redistribution suppression works
EXAMPLE: yesterday: team=platform: $5,000 (was $3,000 day before) → +67% team=services: $3,000 (was $5,000 day before) → -40% TOTAL: $8,000 (was $8,000) → 0% change
WITHOUT SUPPRESSION: platform team gets a warning alert "+67%" (drops never alert, so services gets nothing) Platform investigates Time wasted on a "no net change" event
WITH SUPPRESSION: Net change: $0, under 20% of the largest move ($2,000 x 20% = $400) Team-level alerts suppressed Org-level: no alert (0% change)
THE PATTERN: Cost shifting between teams isn't a meaningful cost event It's a redistribution Alerts would be noise
System recognizes the pattern; suppressesThe suppression is the noise-reduction mechanism.
The 20% threshold
RULE: if |sum of every team's dollar change| < 20% of the largestsingle-team |dollar change|, drop all team-level anomalies for the org
EXAMPLES:
CASE 1 (suppress): Team A: +500% (was $100, now $600) Team B: -98% (was $500, now $10) Net change: +$500 - $490 = $10; 20% of the largest move ($500) = $100 → SUPPRESS: $10 is under $100
CASE 2 (don't suppress): Team A: +500% (was $100, now $600) Team B: +0% (was $500, now $500) Net change: $500 (real increase), above $100 → DON'T SUPPRESS; team A alert fires
CASE 3 (don't suppress): Team A: +200% (was $100, now $300) Team B: -10% (was $500, now $450) Net change: +$200 - $50 = $150; 20% of the largest move ($200) = $40 → DON'T SUPPRESS; team A alerts (team B's drop is not an anomaly)Net change captures whether org-level cost actually increased.
What is NOT suppressed
ALWAYS FIRES (regardless of suppression):
1. ORG-LEVEL ANOMALIES Reflect total spend changes Always fire when significant
2. RESOURCE-LEVEL ANOMALIES A single resource spiking is reported regardless of team-level pattern The resource is the source-of-truth signal
3. CLOUD-ACCOUNT OR RESOURCE-GROUP DIMENSIONS Have their own detection logic Not affected by team-level suppression
4. RESOURCE ANOMALIES contributing to a team-level spike The resource fires The team-level might suppress But the resource is still surfaced
SUPPRESSION is targeted only at team-level dimensions Other dimensions independentThe targeted suppression preserves visibility while reducing noise.
Why suppress
WITHOUT SUPPRESSION: Cost shift to a different team category fires team-level alerts Team A gets an alert for its rise (Team B's drop does not alert) Team A investigates Time wasted on "no net change" events
WITH SUPPRESSION: Alerts suppress when net is small Teams investigate when net change is real Time spent on actual cost events
SIGNAL-TO-NOISE improves significantly Team alerts that fire = team-specific events Not redistribution noiseThe improvement is meaningful in mid-to-large orgs with many teams.
The threshold is fixed
The 20% figure is the same for every org. There is no setting to tighten or loosen it.
WHAT YOU CANNOT DO: Change the 20% for your org Turn team redistribution suppression off
WHAT YOU CAN DO WHEN TEAM ALERTS ARE NOISY: Lean on resource-level subscriptions for the teams that matter Watch the org-level view for real changes in total spend Clean up team tags so fewer resources move between teamsThe fixed rule keeps team alerts focused on real team-specific events. Your control is in which dimensions you subscribe to, not in the rule.
When redistribution might mask a real issue
If a team’s “shift” was actually two separate events (real spike on Team A, unrelated drop on Team B coincidentally), suppression might hide a real issue:
SCENARIO: Team A: legitimately spiked 500% (real issue) Team B: had a separate cost decrease unrelated to A Net change between A and B is small Suppression fires
RESULT: real Team A issue is masked at team levelThis is rare but possible. Mitigations exist:
MITIGATIONS (multiple safety nets):
1. ORG-LEVEL ANOMALY will NOT help here Net change is small, so the org total barely moved Org-level stays quiet
2. RESOURCE-LEVEL ANOMALIES on Team A's resources fire (if the org has a dimension-level subscription) Individual resources show their cost spike Even if team-level is suppressed Operator drills into resources
3. Other dimensions catch it: Cloud-account: may catch Resource-group: may catch Investigation discovers the maskingSo the Team A issue would surface at resource level (or another dimension), even if team-level was suppressed. Org-level will not catch it.
Nothing to audit later
SUPPRESSED TEAM ANOMALIES ARE NOT STORED: They are dropped before anything is written There is no suppressed events log to review afterwards
CROSS-CHECK INSTEAD: On a day that looks suspicious, open the resource-level anomalies and the org-level view for that date A real team spike still shows up on its resourcesIf you need a record of why a team stayed quiet, the resource-level anomalies are it.
2. Demo
A team’s investigation with suppression in action:
T+0 Daily anomaly run
T+1 min Org-level: +5% (modest; below threshold; no alert) Team-level alerts: SUPPRESSED (3 teams shifted; net small; redistribution detected)
T+1 min Resource-level: 1 anomaly on team=ml's "i-0gpu-train-7" (+500% deviation, was $5/day, now $30/day)
T+5 min Team opens the resource anomaly Investigation: Yes, this resource started running today Was triggered by a routine training job Within normal pattern for team=ml
T+10 min Conclusion: This is expected and unrelated to redistribution Action: no action needed (legitimate workload)
T+10 min Note: The team-level "shifts" represent normal redistribution Across teams (some teams' workloads ran, others didn't) No real anomaly to investigate at team level
WITHOUT SUPPRESSION: 3 teams would have gotten alerts Each would have investigated All would have concluded "no real issue" 9 person-hours wasted on noise
WITH SUPPRESSION: 1 team (ml) investigated 1 resource Real issue found (legitimate workload; no action) 10 minutes spent on actual signalRedistribution suppression worked: kept attention on the real signal.
3. Hands-on (5 min)
Check redistribution suppression:
□ STEP 1: Open Cost Reports for the last 30 days Team-level anomalies: _____ Days where several teams shifted but none alerted: _____
□ STEP 2: Cross-check those days at resource level Any resource-level anomalies on the quiet teams? _____ Did any look like potential masking? _____
□ STEP 3: Cross-check with org-level Any org-level anomalies on those days? If yes: investigate via org-level and resource-level
□ STEP 4: Review your subscriptions Teams that need resource-level subscriptions: __________ Team tags to clean up: __________
□ STEP 5: Document decision Subscription changes: __________ Rationale: __________A 10-minute audit shows whether your subscriptions catch what suppression hides.
4. Knowledge check
Q1
Team A goes up $4,000, Team B goes down $3,900. Net change tiny. The system:
A. Fires both team-level alerts
B. Suppresses both team-level alerts
C. Fires Team A only
D. Fires Team B only, as the larger mover
Show answer
Correct: B. The cost shift is redistribution, not a real cost event. Org-level still fires if net change is large; resource-level still fires for specific resources. Suppression prevents redistribution noise.
Q2
A real Team A spike happens at the same time as an unrelated Team B drop. Suppression might mask. Mitigation:
A. Nothing fires at all; the suppression is entirely complete
B. Only the Team B drop is reported
C. Cannot mitigate
D. Resource-level anomalies on Team A’s resources still fire
Show answer
Correct: D. Suppression only targets team-level, so resource-level anomalies (for a subscribed org) still catch the real spike. Org-level will not, because the org total barely moved.
Q3
Team-level alerts in a large org feel noisy. What can the team change?
A. Lower the suppression threshold to 10% in their anomaly settings
B. Open the suppressed events log and restore the useful alerts
C. Add resource-level subscriptions for the teams that matter
D. Ask for team-level detection to be switched off for the org
Show answer
Correct: C. The 20% threshold is fixed for every org and suppressed team records are not stored. Resource-level subscriptions and the org-level view are the levers you control.
5. Apply
Suppression runs for every org with a fixed 20% threshold. There is no setting.
For your team: on quiet days with big team shifts, cross-check resource-level anomalies; add resource-level subscriptions where a masked spike would hurt.
Module quiz
Complete M2.10 → 10-question module quiz.
Related lessons
- L1: The seven dimensions
- L2: Detection methods
- L3: Severity bands
- L4: Root cause analysis
- T5.M5.5: Anomaly response