Skip to main content

Anomaly Detection

CloudWise Shield includes automatic cost anomaly detection. Once a day it checks your AWS spending against your recent baseline and alerts you when a service's cost jumps.

How It Works​

  1. Daily Analysis: Every morning at 8 AM UTC, we analyze your past 30 days of AWS costs
  2. Latest Complete Day: Detection runs on the latest complete day of cost data, typically 1-2 days behind — AWS cost data itself has a short delivery lag, so "today" almost never has a full day's numbers yet. If your newest cost data is more than 3 days old, that account is skipped for this run rather than evaluated on stale numbers.
  3. Statistical Detection: We use z-score analysis to identify costs that significantly deviate from your historical baseline
  4. Smart Alerts: Only meaningful spikes are flagged (minimum $5 change, >2 standard deviations)
  5. Notifications: Alerts go out by Slack and/or email after each daily run
  6. No Duplicate Alerts: The same day's spike is never alerted twice, even if it's still the latest available data across two consecutive runs

Severity Levels​

SeverityTriggerDescription
🔴 CRITICAL>4 std devsExtreme cost spike requiring immediate attention
🟠 HIGH>3 std devsSignificant cost increase, investigate soon
🟡 MEDIUM2 to 3 std devsNotable deviation from normal spending

A change below 2 standard deviations is never alerted.

Setting Up Slack Alerts​

CloudWise supports per-category Slack channels — anomaly detection can send to its own dedicated channel, separate from budget alerts, waste reports, and remediation notifications. See the Slack Integration Guide for the full multi-channel setup.

Quick Setup​

  1. Create a Slack Incoming Webhook:

    • Go to Slack API
    • Click "Create your Slack app" (or use an existing CloudWise app)
    • Enable "Incoming Webhooks"
    • Click "Add New Webhook to Workspace"
    • Select the channel for anomaly alerts (e.g. #cost-anomalies)
    • Copy the webhook URL

  2. Configure in CloudWise:

    • Go to Settings → Notifications
    • Find the Cost Anomaly Detection card
    • Turn on Send to Slack
    • Paste your webhook URL
    • Click Test Connection, then click Save Changes

Alert Configuration​

Detection rule​

Detection uses one fixed rule for every account: a day's cost for a service must be at least 2 standard deviations above its 30-day average, and at least $5 higher in dollars. The $5 floor stops alerts on services with very small baselines, where a tiny change looks like a big percentage swing.

The Notifications settings page states this same rule; it has no threshold to tune. What you control is whether alerts are on and where they go (email, Slack).

Viewing Alerts​

Dashboard Widget​

The Cost anomalies card on your dashboard shows recent alerts. Each row shows the service, region, baseline cost, current cost and percentage change. Rows are not clickable.

Alert Details​

Each alert includes:

  • Service & Region: Which AWS service and where
  • Baseline Cost: Your 30-day average for that service
  • Current Cost: The actual cost on the latest complete day of data (see "How It Works" above — typically 1-2 days behind, not necessarily today)
  • Change Amount: Dollar increase (shown in the Slack message and the email; the dashboard card shows baseline, current and percentage change only)
  • Percentage Change: How much higher than normal
  • Severity: Urgency level

Best Practices​

  1. Connect Slack: Slack puts alerts where your team already works
  2. Review Weekly: Review the Cost anomalies card on your dashboard weekly
  3. Act on CRITICAL: These warrant immediate investigation

What Triggers False Positives?​

Sometimes anomalies aren't problems:

  • Monthly billing cycles: Some services bill at month end
  • Scheduled jobs: Batch processing that runs periodically
  • New resources: Just-launched services will spike initially

If you see a recurring pattern, it's not a true anomaly. Expected spikes cannot be acknowledged in the app; repeat spikes for the same service are held back for a cooldown period unless the excess grows sharply.

Frequently Asked Questions​

Q: Why didn't I get an alert?

  • The change may be under 2 standard deviations or under $5, the same service may have alerted recently (a repeat inside the cooldown is only sent if the excess grows sharply), the account's newest cost data may be several days old, or the account may be on the Free plan
  • You need at least 7 days of cost history for analysis
  • Check that Slack webhook URL is valid

Q: Can I get alerts in Microsoft Teams?

  • Not yet, but it's on our roadmap. Slack and email are currently supported.

Q: How quickly are alerts sent?

  • Detection runs daily at 8 AM UTC
  • Slack/email notifications are sent after each daily run

Q: Is anomaly detection available on Free tier?

  • No, anomaly detection is a Shield tier feature (from $19/mo or $149/year)

Need Help?​