Anomalies

Learn what North flags as a cost anomaly, how it grades severity, and how to tune detection for your account.

North watches your daily cost and reports the days that do not fit your own history. Detection runs on its own. There is nothing to configure before you see results.

Open the page from Analyze > Anomalies.

AWS accounts need Advanced Permissions for this page. If those permissions are missing, the page states so instead of showing results. See AWS permissions to grant them.

What North Flags

North groups your cost by linked account, service, and usage type. Where it can attribute a change to a single resource, it reports that resource as well.

Inside each group, North compares every day against the running average and spread of that group's own history. A day is flagged when two conditions hold together:

• The day sits far from the group's history, measured as a z-score, or the day-over-day change is large against the group's average.
• The dollar change clears a floor. That floor is the larger of your cost change threshold and your critical percentage applied to the group's average daily cost.

Each flagged day is a spike or a dip.

• A spike is a day where cost went up.
• A dip is a day where cost went down. A dip can point to a deleted resource, an expired commitment, or an unplanned shutdown.

Two cases are excluded on purpose. A dip that continues a fall already under way over the previous three days is not reported. The first day a service ever has cost is masked, because a new service is expected to look like a spike.

Severity

There are two severity levels.

Severity	Meaning
Critical	The cost increase is larger than your critical percentage applied to the group's average daily cost.
Medium	Every other flagged day.

Only spikes can be Critical. A dip is a decrease, so it never passes the Critical test, and a dip is always Medium.

A service or a resource takes the highest severity of its own days. One Critical day makes the whole anomaly Critical.

Pattern Recognition

North scans each group's history for spikes and dips that repeat every week or every month. Where a flagged day matches one of those patterns, North labels the day and gives the reason. Use this to separate a monthly billing cycle or a scheduled weekend job from a real problem.

The list marks any anomaly that has pattern matches. Open the anomaly, then hover a marked point on the chart to read the explanation.

Reading the Page

Four figures sit above the list: Total Anomalies, Critical, Medium, and Total Cost Change. Each figure counts what your filters currently show, and none of them counts a masked anomaly.

Filter the list by service and by linked account. Google Cloud accounts show Project in place of Linked Account. The search box narrows the list further.

Each row shows the severity, the service, the usage type, the linked account, the cohort, the number of anomaly days, the number of resources, and the most recent anomaly date. Click a column heading to sort by it.

Click a row to open the anomaly. The detail panel gives you:

Field	Meaning
Severity	Critical or Medium, for this anomaly.
Spikes	The number of days where cost went up.
Dips	The number of days where cost went down.
Patterns	The number of pattern matches across those days. A match suggests an expected movement rather than a problem.
Largest Change	The largest single-day cost increase in the anomaly.

Below the fields, a chart plots the last 90 days of cost for the group, with each anomalous day marked.

Settings

Click Account Preferences, the gear control at the top right of the page, to tune detection. The settings apply to the whole account. You need write permission on anomalies to change them.

Setting	What it does	Default	Minimum
Cost change threshold	The minimum dollar amount for a change to count as an anomaly.	$10.00	$10
Percentage increase for critical alerts	The minimum cost increase, measured against the group's average daily cost, for an anomaly to be Critical.	50%	1%
Limit number of services to show anomalies for	The number of services North reports anomalies on, ranked by size.	20	1

Raise the cost change threshold to cut small anomalies. Raise the critical percentage to reserve Critical for larger increases. Lower the service limit to keep the page focused on your biggest spenders.

Acting on an Anomaly

Open an anomaly and use one of the two controls at the bottom of the panel.

• Resolve marks the anomaly as handled.
• Not a good recommendation? marks it as one you want ignored.

Both move the anomaly to the bottom of the list and take it out of the four figures above. North records which action you took, and uses that record when it evaluates the same group again.

To bring in other people, use the share control. You can send an anomaly by email, post it to Slack, or open a Jira issue from it. Select several anomalies with the row checkboxes to share them together.