Investigating anomalies

Once an anomaly surfaces, investigation answers the follow-up: what actually drove this? CloudQuell can take one service and trace the spike down to the resources and accounts behind it.

Note

Anomaly investigation is a paid feature. On the Free plan the anomaly detail is locked behind an upgrade prompt. See Plans & billing.

What a deep-dive pulls together

Selecting an anomaly in the dashboard opens two things:

• A trend chart for that service — the daily series for a live spike, or the weekly/monthly series otherwise — so a one-day jump is easy to tell apart from a sustained climb.
• A per-resource breakdown for the flagged period — which specific resources carried the cost, with each one’s dollar delta, so you can see exactly what drove the increase.

You read this evidence yourself; the dashboard doesn’t emit a single “is this really anomalous?” verdict string. That computed verdict is available through the MCP investigate_anomaly tool (see Investigating with an agent below).

Contributing resources and accounts

The dashboard breakdown lists each contributing resource with its owning linked account, so you can see not just which resources but which account carried the increase — pinpointing the owner instead of stopping at the service level. Through the MCP tool you can go further and anchor an investigation to a specific date and account and cap how many top resources come back, answering questions like which resources and which linked account drove the AmazonRDS spike on June 15?

Investigating with an agent

Through the CloudQuell MCP server, investigation is a single request:

“Drill into AmazonRDS for 2026-06-15 — which resources and accounts drove it?”

The agent runs the chained deep-dive and returns the drivers plus the verdict. It’s a read-only action, so it never changes anything.

Explaining the root cause

Once you know the drivers, the AI Explain / AI Summary feature can turn the breakdown into a plain-language explanation of the root cause — useful for sharing the “why” with people who won’t dig through the numbers themselves.

Next steps

• Sensitivity & dismissal — dismiss a spike you’ve confirmed is expected.
• Alerts overview — get told about future spikes automatically.