> For the complete documentation index, see [llms.txt](https://docs.north.cloud/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.north.cloud/docs/features/anomalies.md). # Anomalies Learn what North flags as a cost anomaly, how it grades severity, and how to tune detection for your account. North watches your daily cost and reports the days that do not fit your own history. Detection runs on its own. There is nothing to configure before you see results. Open the page from **Analyze > Anomalies**. {% embed url="" %} {% hint style="info" %} AWS accounts need Advanced Permissions for this page. If those permissions are missing, the page states so instead of showing results. See [AWS permissions](/docs/getting-started/permissions-required/aws-permissions.md) to grant them. {% endhint %} ## What North Flags North groups your cost by linked account, service, and usage type. Where it can attribute a change to a single resource, it reports that resource as well. Inside each group, North compares every day against the running average and spread of that group's own history. A day is flagged when two conditions hold together: * The day sits far from the group's history, measured as a z-score, or the day-over-day change is large against the group's average. * The dollar change clears a floor. That floor is the larger of your cost change threshold and your critical percentage applied to the group's average daily cost. Each flagged day is a spike or a dip. * A **spike** is a day where cost went up. * A **dip** is a day where cost went down. A dip can point to a deleted resource, an expired commitment, or an unplanned shutdown. Two cases are excluded on purpose. A dip that continues a fall already under way over the previous three days is not reported. The first day a service ever has cost is masked, because a new service is expected to look like a spike. ## Severity There are two severity levels. | Severity | Meaning | | ------------ | ---------------------------------------------------------------------------------------------------- | | **Critical** | The cost increase is larger than your critical percentage applied to the group's average daily cost. | | **Medium** | Every other flagged day. | Only spikes can be Critical. A dip is a decrease, so it never passes the Critical test, and a dip is always Medium. A service or a resource takes the highest severity of its own days. One Critical day makes the whole anomaly Critical. ## Pattern Recognition North scans each group's history for spikes and dips that repeat every week or every month. Where a flagged day matches one of those patterns, North labels the day and gives the reason. Use this to separate a monthly billing cycle or a scheduled weekend job from a real problem. The list marks any anomaly that has pattern matches. Open the anomaly, then hover a marked point on the chart to read the explanation. ## Reading the Page Four figures sit above the list: **Total Anomalies**, **Critical**, **Medium**, and **Total Cost Change**. Each figure counts what your filters currently show, and none of them counts a masked anomaly. Filter the list by service and by linked account. Google Cloud accounts show Project in place of Linked Account. The search box narrows the list further. Each row shows the severity, the service, the usage type, the linked account, the cohort, the number of anomaly days, the number of resources, and the most recent anomaly date. Click a column heading to sort by it. Click a row to open the anomaly. The detail panel gives you: | Field | Meaning | | ------------------ | ------------------------------------------------------------------------------------------------------------- | | **Severity** | Critical or Medium, for this anomaly. | | **Spikes** | The number of days where cost went up. | | **Dips** | The number of days where cost went down. | | **Patterns** | The number of pattern matches across those days. A match suggests an expected movement rather than a problem. | | **Largest Change** | The largest single-day cost increase in the anomaly. | Below the fields, a chart plots the last 90 days of cost for the group, with each anomalous day marked. ## Settings Click **Account Preferences**, the gear control at the top right of the page, to tune detection. The settings apply to the whole account. You need write permission on anomalies to change them. | Setting | What it does | Default | Minimum | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------- | ------- | | **Cost change threshold** | The minimum dollar amount for a change to count as an anomaly. | $10.00 | $10 | | **Percentage increase for critical alerts** | The minimum cost increase, measured against the group's average daily cost, for an anomaly to be Critical. | 50% | 1% | | **Limit number of services to show anomalies for** | The number of services North reports anomalies on, ranked by size. | 20 | 1 | Raise the cost change threshold to cut small anomalies. Raise the critical percentage to reserve Critical for larger increases. Lower the service limit to keep the page focused on your biggest spenders. ## Acting on an Anomaly Open an anomaly and use one of the two controls at the bottom of the panel. * **Resolve** marks the anomaly as handled. * **Not a good recommendation?** marks it as one you want ignored. Both move the anomaly to the bottom of the list and take it out of the four figures above. North records which action you took, and uses that record when it evaluates the same group again. To bring in other people, use the share control. You can send an anomaly by email, post it to Slack, or open a Jira issue from it. Select several anomalies with the row checkboxes to share them together. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.north.cloud/docs/features/anomalies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.