Cost Anomalies
How CostLens detects, explains, and helps you investigate unexpected cloud spend across AWS, Azure, and GCP - the Cost Anomalies workspace, the chart on Billing and the Dashboard, and every card on the Cost Anomalies page.
Cost Anomalies is CostLens's multi-cloud spend-spike monitoring, investigation, and AI root-cause platform. Detection is rule-based (deterministic, cheap, checkable) - it compares each service's daily spend to a 28-day seasonal baseline (the same weekday when there's enough history, otherwise a rolling average), widened for services that are naturally spiky. A day that crosses the threshold becomes a persisted anomaly event, which is what powers the red dots on every chart, the alert emails, and the rows in every table described below.
AI never decides what's anomalous
Aevi (CostLens's AI) only explains an anomaly that the rule-based detector already flagged - grounded in the detector's own numbers (baseline, deviation %, drivers) so it can't invent a cause. It never decides whether something is an anomaly in the first place.
Where cost is misbehaving
The breakdown rail on the Cost Anomalies page ranks excess spend (actual minus baseline, summed over the window) by whichever dimension you pick:
- Service - which AWS/Azure/GCP service is driving the excess.
- Account - which connected account, when you're viewing more than one.
- Region - where the excess landed. This is a read-out only; anomalies are detected per service, not per region, so clicking a region doesn't narrow the page.
- Cloud - which provider (AWS / Azure / GCP), for orgs connected to more than one.
Clicking a Service, Account, or Cloud row narrows the whole page - the chart, the history section, and the table below - to that value.
Spend and spikes chart
The daily spend line for the selected account, with red dots marking spike days. For a single account, the dots come from a live recalculation of the biggest spikes in the window, not only the persisted alert history - so a spike can appear here even before the automated detector's next run has caught up and emailed an alert. Select All accounts and the chart switches to one line per account (grouped, with a "Other" bucket for very large estates), each with its own dots.
Hover a point for that day's spend, its percentage versus the account's average, and - on a flagged day - the top service(s) that drove it.
Anomaly history
A monthly trend of total excess spend from flagged spikes, so you can see at a glance whether your anomaly posture is improving or worsening. The trend badge (trending up / down / steady) always compares the two most recently completed months - never the current, still-in-progress month, which would otherwise read as a false "down" trend for the first few days of every month.
Recurring anomalies
Services that have flagged 3 or more times in the last 90 days, ranked by total excess spend. A repeat offender is one of two things:
- Genuinely expected - a workload that legitimately runs hot on a schedule. This is exactly what a mute rule ("mark expected", available from any anomaly row) is for - it stops the noise for that specific service without turning off detection for anything else.
- A real, recurring cost problem - something worth a closer look each time it happens, since it keeps costing you money.
CostLens suggests which one applies based on how often the service has recurred - a service that has doubled the occurrence threshold is called out for a mute rule; anything below that is flagged as worth investigating.
Anomalies table
Every flagged service-day in the selected window, sortable and searchable across cloud, account, service, severity, and status (New / Acknowledged / Muted). Expand any row for the full investigation:
- Root-cause breakdown - the contributing regions and resource owners (from tags), ranked by how much of the spike they explain.
- Candidate resources - correlated from your open recommendations and the asset inventory. These are candidates to investigate, not measured per-resource cost - CostLens's billing data is aggregated at the service/region level, not per resource.
- Aevi summary - a five-part AI explanation (cause, top contributors, why spend rose, business impact, recommended actions), generated once per anomaly and cached so revisiting it is free.
- Forecasted impact - if the spike's spend has stuck around after the day it was detected, a projected monthly and annual impact if nothing changes; a one-day burst that self-corrected is called out as resolved instead.
- Investigate links - jump straight to the affected service's recommendations, or open the same day scoped in the Cost Anomalies workspace.
Diffuse spikes get their own account-total row
If a day's total spend rose but no single service crossed the threshold on its own - a spike spread thinly across several services, or a brand-new workload with no history yet to compare against - CostLens flags it as an account-total anomaly (shown as "All services (account total)"), with a per-service breakdown in its expanded row.
Alerts
A critical or high-severity anomaly emails your org's admins, operators, and finance/ops distribution list, and - if your org has Slack or Microsoft Teams configured - posts the same notice to your team channel. Both include the projected impact and a link straight to the flagged spike. See Notifications for how to manage who gets alerted and at what severity.