Anomaly detection

CloudQuell watches your spend and flags services whose costs move in a way that doesn’t fit their recent pattern. Those flags are anomalies — the starting point for the most common FinOps question: why did spend spike?

Note

Anomaly detail is a paid feature. On the Free plan you get a KPI peek — the headline anomaly number is visible, but the full anomaly list, drill-down, and dismissal are locked behind an upgrade prompt. See Plans & billing.

How detection works

Anomalies are derived from your own cost history rather than a fixed dollar rule. Three detectors run over every service and their findings merge into one feed:

• Live (rolling 30 days) — compares the most recent 30 days of spend against the prior 30-day windows (up to three of them) as a baseline, anchored to the newest day of data rather than the calendar. This catches a runaway within days instead of waiting for the month to close.
• Weekly — the last complete week against a rolling 4-week baseline.
• Monthly — the last complete month against a rolling 3-month baseline.

A service is flagged when its increase clears a percentage threshold and the dollar change clears a floor (the floor kills big-percentage moves on trivial spend). At the default Balanced sensitivity those thresholds are roughly 30% month-over-month, 40% week-over-week, and 30% for the live rolling-30-day window — see Sensitivity & dismissal to adjust them. Spend that appears for a service with no baseline at all is flagged as a new-service anomaly, and a large, sustained drop is surfaced too on the weekly and monthly windows — informational, so a silently-stopped workload gets noticed.

Because detection is grounded in movement, a service that has always been expensive but stable won’t be flagged; a smaller service that suddenly doubles will.

What an anomaly shows

Each flagged anomaly identifies the service involved, the detection window it was caught in (Live, Weekly, or Monthly), the size of the movement (the percentage jump and the dollars behind it), and the period it occurred in. When the same service trips more than one window, the strongest signal leads the row and the others show as a compact “+N” badge (hover it to see which other windows flagged the service). That’s enough to rank anomalies and decide which one to open first.

Severity

Anomalies are ranked by severity so the biggest, most unusual movements sort to the top of the feed. A larger percentage jump on more spend ranks higher than a small wobble. You can narrow the feed with the window chips (Live / Weekly / Monthly) and a minimum-severity filter, so noise doesn’t crowd out the signal. To change what gets flagged in the first place rather than just what’s shown, use the sensitivity selector — see Sensitivity & dismissal.

Next steps

• Investigating anomalies — deep-dive one service to the resources and accounts driving it.
• Sensitivity & dismissal — tune the threshold and silence non-actionable anomalies.