Skip to main content

Anomaly Detection

CloudWise Shield includes automatic cost anomaly detection that monitors your AWS spending 24/7 and alerts you when unusual patterns are detected.

How It Works​

  1. Daily Analysis: Every morning at 8 AM UTC, we analyze your past 30 days of AWS costs
  2. Latest Complete Day: Detection runs on the latest complete day of cost data, typically 1-2 days behind — AWS cost data itself has a short delivery lag, so "today" almost never has a full day's numbers yet. If your newest cost data is more than 3 days old, that account is skipped for this run rather than evaluated on stale numbers.
  3. Statistical Detection: We use z-score analysis to identify costs that significantly deviate from your historical baseline
  4. Smart Alerts: Only meaningful spikes are flagged (minimum $5 change, >2 standard deviations)
  5. Instant Notifications: Receive alerts via Slack and/or email within minutes of detection
  6. No Duplicate Alerts: The same day's spike is never alerted twice, even if it's still the latest available data across two consecutive runs

Severity Levels​

SeverityTriggerDescription
🔴 CRITICAL>4 std devsExtreme cost spike requiring immediate attention
🟠 HIGH>3 std devsSignificant cost increase, investigate soon
🟡 MEDIUM>2 std devsNotable deviation from normal spending
🟢 LOW>1.5 std devsMinor variance, worth monitoring

Setting Up Slack Alerts​

CloudWise supports per-category Slack channels — anomaly detection can send to its own dedicated channel, separate from budget alerts, waste reports, and remediation notifications. See the Slack Integration Guide for the full multi-channel setup.

Quick Setup​

  1. Create a Slack Incoming Webhook:

    • Go to Slack API
    • Click "Create your Slack app" (or use an existing CloudWise app)
    • Enable "Incoming Webhooks"
    • Click "Add New Webhook to Workspace"
    • Select the channel for anomaly alerts (e.g. #cost-anomalies)
    • Copy the webhook URL

  2. Configure in CloudWise:

    • Go to Settings → Notifications
    • Find the Cost Anomaly Detection card
    • Toggle "Enable Slack notifications"
    • Paste your webhook URL
    • Click "Test Connection" to verify
    • Save your preferences

Alert Configuration​

Threshold Percentage​

Set the minimum percentage increase to trigger an alert (default: 20%).

For example, with a 20% threshold:

  • If your average EC2 cost is $100/day
  • An alert triggers when daily EC2 cost exceeds $120

Minimum Spend​

Filter out noise by setting a minimum dollar change (default: $5).

This prevents alerts for services with very low baseline costs where small absolute changes can create large percentage swings.

Viewing Alerts​

Dashboard Widget​

The Cost Anomalies widget on your dashboard shows recent alerts:

  • Click an alert to see details
  • Use "Acknowledge" to mark as reviewed
  • Acknowledged alerts won't show as pending

Alert Details​

Each alert includes:

  • Service & Region: Which AWS service and where
  • Baseline Cost: Your 7-day average
  • Current Cost: The actual cost on the latest complete day of data (see "How It Works" above — typically 1-2 days behind, not necessarily today)
  • Change Amount: Dollar increase
  • Percentage Change: How much higher than normal
  • Severity: Urgency level

Best Practices​

  1. Start with Default Thresholds: The 20% threshold works well for most accounts
  2. Connect Slack First: Real-time alerts help you respond faster
  3. Review Weekly: Check the alerts dashboard even for acknowledged items
  4. Tune Over Time: If you get too many alerts, increase the threshold
  5. Act on CRITICAL: These warrant immediate investigation

What Triggers False Positives?​

Sometimes anomalies aren't problems:

  • Monthly billing cycles: Some services bill at month end
  • Scheduled jobs: Batch processing that runs periodically
  • New resources: Just-launched services will spike initially

If you see a recurring pattern, it's not a true anomaly. Consider adjusting thresholds or acknowledging expected spikes.

Frequently Asked Questions​

Q: Why didn't I get an alert?

  • The change may be below your threshold
  • You need at least 7 days of cost history for analysis
  • Check that Slack webhook URL is valid

Q: Can I get alerts in Microsoft Teams?

  • Not yet, but it's on our roadmap. Slack and email are currently supported.

Q: How quickly are alerts sent?

  • Detection runs daily at 8 AM UTC
  • Slack/email notifications are sent within minutes of detection

Q: Is anomaly detection available on Free tier?

  • No, anomaly detection is a Shield tier feature (from $19/mo or $149/year)

Need Help?​