Cost Anomaly Detection with a Root Cause per Spike
A spike in the bill is only actionable when you know where it is and why it happened.
Where it looks
Anomaly detection runs every day over ZopNight’s cost data and checks spend at several levels at once: the whole organisation, each cloud account, resource type, resource group, individual resource and team. For Azure it also checks the Azure resource group and tenant hierarchy. A spike that is invisible in the org total can still surface on the one team that caused it.
How a day is judged
Each day is compared two ways: the percent deviation from a seven-day rolling average, and a z-score. The higher severity of the two wins.
| Severity | Deviation from baseline |
|---|---|
| Warning | 30 percent up to 100 percent |
| Critical | 100 percent up to 500 percent |
| Emergency | 500 percent or more |
Guards keep noise out. A series needs at least four data points, the spend must be at least a dollar a day, and the variation must be meaningful relative to the mean. When cost moves between two teams with little net change, both anomalies are suppressed as a redistribution rather than reported twice.
The root cause comes with it
Each anomaly carries a root cause analysis, so the investigation starts with a hypothesis:
- an instance resize that changed the hourly rate
- a new resource that appeared in the period
- a reservation or savings plan expiry
- a schedule failure that left something running
- an unscheduled usage increase
Seeing and subscribing
Anomalies appear as markers on the cost trend chart and in the anomalies report, filterable by date range, whether or not you have configured any notification channel. Evaluation always runs; notifications are an optional layer on top. When you do subscribe, you pick the dimension and severity, alerts are de-duplicated by date and entity, and an escalation in severity notifies again. Resource-level alerts are limited to the largest deviations so a noisy day does not flood the channel.
Related
Anomalies read from the same data as cost reporting and pair with budgets in FinOps automation. For background, see the anomaly detection guide.
Questions we get a lot.
Do I need Slack or Teams set up to see anomalies?
No. Detection runs daily for every organisation and the results show on the cost trend chart and anomalies report. Channels only add delivery.
Why was a spike not reported?
Common reasons are too few data points, spend under a dollar a day, or a shift between two teams that nets out, which is treated as redistribution.