# Cloud cost anomaly detection | ZopNight

> Spend watched across seven dimensions and flagged on the daily pass when it breaks pattern, with the likely cause attached and guards against false alarms.

Source: https://zop.dev/zopnight/anomaly-detection

---

_Likely cause attached_

## Spend spikes, with the likely cause.

ZopNight watches spend across seven dimensions and flags the day it breaks pattern. Each anomaly arrives with its most likely cause: a resize, a new resource, an expired reservation, a schedule that failed to fire.

- 7 — levels watched, org to resource
- 5 — likely causes it can name
- 4 days — of history to start
- 1 — alert per spike per day

Free to start. No card. The playground just needs your work email.

## A red line is not an answer.

Every flag says what most likely changed.

- 01. Watch everything — Org, cloud account, resource type, resource group, resource, team, and Azure resource groups and tenants. Every one is checked daily.
- 02. Score it twice — Deviation from the 7-day rolling average, and how unusual the day is for that series. Whichever says it is more severe wins.
- 03. Name the likely cause — Instance resizes, new resources, reservation or savings-plan expiry, schedule failures and unscheduled usage growth. You get the likely why, not just the spike.
- 04. Stay quiet otherwise — Cost that moves between teams without really changing is treated as a reorg, not an incident. Resource-level alerts cap at the ten biggest.

## Built so nobody mutes it.

An alert people ignore is worse than none.

- Severity: Warning at 30 to 150 percent deviation, critical at 150 to 500, emergency above 500.
- False positives: Detection starts once there are at least four days of cost history. It also needs a dollar a day and a spread above ten percent of the mean before anything fires.
- Routing: Subscribe by dimension and by severity, scoped to the org, an account or a group. The same anomaly on the same day notifies once, and again only if it escalates.
- Always evaluated: Anomalies are computed for every org whether or not a notification channel exists. Alerts are an optional layer on top.

## Hear about the spike on the next daily pass.

Connect an account. Detection starts once there are at least four days of cost history.

[object Object]