Cost Anomaly Detection

With the Anomaly Detection feature, you can monitor costs more closely by setting up an alert that will notify you if your spending changes suddenly. It compares your previous cost trends with your current spending to determine if there’s an anomaly in your expenses. If you have a sudden, significant increase in your spending, you’ll receive an alert. This helps you to keep track of potential waste, unexpected charges, or unintentionally terminated services.

Anomaly Alerts

If you’re a member of an organization with the appropriate permissions, you can get alerts about spending anomalies. To see alerts, you must have “All Services” selected in the Organization view drop-down on the top right of your Service Portal window. You can set thresholds for the alerts, and exclude some service types from the alert. The alerts will show up in the Alerts tab of the Cost Dashboard and there will be an alert notification on the main Service Portal Dashboard. You can also configure email alerts. Costs will include all costs visible based on ownership and ownership policies. Any service types that you exclude during configuration won't be included in the anomaly calculations.

If you have billing retrieval configured on public clouds (AWS, Azure, and Google), cost anomaly alerts will reflect the data you've retrieved. Anomaly detection is based on the billing data that's currently available. Because the most recent cost for public cloud billing data is for the day before yesterday, the most recent cost that cost anomaly alerts will apply to is for the day before yesterday.

Commander doesn't retroactively generate anomaly alerts for existing cost data, so anomalies are detected only for the days after you enable the Anomaly Alert feature.

Ownership and Anomaly Alerts

Anomaly alerts are generated based on the total cost for organizations and total cost per service. User-level anomalies aren’t detected. An organization's cost is determined based on owner settings or ownership policy. If a service has an owner, the cost belongs to the owner's organization. If a service doesn’t have an owner, the ownership is determined by the ownership policy setup in the Infrastructure Summary section. Anomaly alerts can’t be configured for parent organizations.

You can see anomaly alerts at the cloud level and at the service type level. In the Alerts table, a Cloud Type entry of "Global" means all cloud types. A Cloud Type entry of, for example, "AWS", means all of your AWS accounts grouped together. A Service Type entry of "All Services" means all Service Types except the excluded types.

Anomaly Alerts and Currency Exchange Rates

Alert costs are converted to your currency preference using the latest available exchange rates at the time of display. Because exchange rates may change over time, you may notice slight fluctuations in the same alerts every day, due to exchange rate changes and not actual cost changes.

Configure anomaly alerts

Anomaly alerts will be displayed on an Alerts tab in the Service Portal Cost Dashboard. Clicking the Details link in each alert takes you to the Daily Costs chart where the anomaly is highlighted. If you click on Details of an alert for a specific service type, the Daily Costs, Monthly Costs, and Most Expensive Regions sections will be pre-filtered to show only that service type. See Trigger anomaly alerts for details on specific threshold settings to fine-tune your alert criteria.

Alerts are saved and not changed, so if you re-configure the alert thresholds, old alerts that were already sent won’t change, but new alerts will reflect the new configuration. Old alerts will also retain their original currency, but new alerts will be in your preferred currency.

To configure Anomaly alerts:

  1. Go to the Service Portal Cost Dashboard.
  2. To display the Cost Anomaly Alerts table, click the Alerts tab.

    3. If you don’t see the Alerts tab, see Troubleshooting anomaly alerts.

  3. To open the Configure Cost Anomaly Alerts dialog, select Configure > Cost Anomaly Alerts.

    4. To see this feature, you must have “All Services” selected in the Organization view drop-down on the top right of your Service Portal window.

  4. Anomaly detection is disabled by default. You can turn it on with the Enable Anomaly Detection checkbox.
  5. To configure which service types to exclude from the anomaly calculations, add the name of the service type to the comma-separated list in the Excluded Service Types field.

    6. The text in this field must be an exact match with the service type name.

  6. To receive email alerts, enable the Send email notification checkbox.

    7. The notification will be sent to the email in your user profile, so ensure that your email is configured correctly in your user profile.

  7. If you want to be alerted for cost decreases as well as cost increases, enable the Allow Anomaly Detection for Cost Decreases checkbox.

    8. Clear the checkbox if you don’t want to be alerted about cost decreases.

  8. The anomaly detection calculation will compare the current day with the cost during the previous several days. Days in mean calculation is the number of days that will be used in the mean value for the calculations.

    9. The maximum number of days that can be entered is 90. It’s recommended that you use multiples of 7 for this value to span the cost over entire weeks.

  9. For the other fields in the Configure Cost Anomaly Alerts dialog, set the thresholds or leave the defaults.

    10. An alert will be triggered if ALL of the conditions of these thresholds are met. See Trigger anomaly alerts for details on specific threshold settings to fine-tune your alert criteria.

  10. Click Apply.

To export a list of alerts to a CSV file, click the Export button in the Alerts table.

Trigger anomaly alerts

The calculations for the alert trigger are based on comparisons between the present cost and values that are represented by the costs for previous days. An alert that’s been generated once won’t be repeated.

An alert will be generated if the conditions are satisfied for ALL of the following:

  • Service type isn’t in the excluded list
  • Delta Threshold (Percent)
  • Cost Change
  • Standard Score

See below for details on the criteria for satisfying each of these conditions.

Delta Threshold (Percent) — This condition is satisfied if the percentage that the daily cost deviates from the mean is larger than the threshold that you’ve configured. You can configure the number of days that will be used for the mean calculation.

Delta Threshold (Percent) Examples:

  • If the mean cost for previous days is 100 USD, the cost for the day is 125 USD, and the threshold (Delta Threshold) is 20%, this condition is satisfied, because the delta percentage is larger than the threshold.
  • If the mean cost for previous days is 100 USD, the cost for the day is 125 USD, and the threshold (Delta Threshold) is 30%, this condition won’t be satisfied and an alert won’t be generated, even if all of the other conditions are satisfied.

Cost Change — This condition is satisfied if the difference between the cost for that day and the mean for previous days is larger than the threshold that you’ve configured. You can configure the number of days that will be used for the mean calculation. Using the Ignore if cost change is below setting in the Configure Cost Anomaly Alerts dialog, you can set the cost change threshold. If this condition isn’t satisfied, an alert won’t be generated, even if all of the other conditions are satisfied.

Cost Change Examples:

Mean (USD)

Cost for the day (USD)

Cost change (USD)

Value you have configured for "Ignore if cost change is below" (USD)Condition satisfied?
5005454530Yes
5005454550No
500490-1050Yes
50059999100No

Standard Score — This condition is satisfied if the standard score for the day is higher than the Standard Score Threshold you’ve configured. This score prevents false positives in environments with highly variable day-to-day costs because it takes into consideration the variability (deviation) of the costs from day to day. Standard score is also known as z-score.

Standard Score Examples:

  • A cost value that has a standard score of 1 means that the number lies a distance measured by one standard deviation above the mean.
  • A cost value that has a standard score of 3 means that the number lies a distance measured by three standard deviations above the mean.
  • A cost value that has a standard score of -1 means that the number lies a distance measured by one standard deviation below the mean.

Excluded Service Types — An alert won’t be triggered if the cost is from a Service Type that's in the Excluded Service Types list. You can add up to 300 service types to be excluded from the anomaly detection calculations. For example, you may want to exclude your tax or support cost, which may be charged once a month.

Notes:

  • In your AWS bill, tax charges are included with each service type. To exclude taxes from the anomaly detection calculations, AWS tax charges are bundled together into their own service type and are excluded by default.
  • By default, the following charges are excluded from anomaly detection: AWS Support (Basic), AWS Support (Business), AWS Support (Developer), AWS Support (Enterprise), AWS Tax, Google Invoice, and Google Support.

Troubleshooting anomaly alerts

If you don’t see an Alerts tab in the Service Portal Cost Dashboard or are getting unexpected results, use the suggestions in this list to troubleshoot your setup.

  • You may not have the correct permissions to view and configure Anomaly Alerts. See your system administrator to change your permissions.
  • To see anomaly alerts, you must have “All Services” selected in the Organization view drop-down on the top right of your Service Portal window.
  • If you can’t see certain service types that you expect to see, they may be in the Excluded Service Types list of the Configure Cost Anomaly Alerts dialog.
  • If you can’t see certain organization-owned services that you expect to see, make sure you're signed in to the right organization.