Catching cost anomalies before they become budget emergencies

Cloud cost surprises fall into two categories: the slow creep nobody notices until the monthly bill arrives, and the sudden spike that doubles a subscription's spend overnight. Both are preventable — but you need different tools for each. Cloud Cost Optimizer handles both with a unified alerting system: **anomaly detection** for spikes and **budget alerts** for the slow creep. ## How anomaly detection works Every 4 hours, CCO's detection engine compares current resource-level costs against rolling baselines: 1. **Fetch current costs** — resource-level data from the latest snapshot (individual VMs, databases, storage accounts) 2. **Compute baselines** — rolling averages over configurable windows (7, 14, or 30 days) 3. **Compare** — calculate deviation percentage and absolute change for each resource 4. **Alert** — if deviation exceeds your threshold (or system defaults: 50% spike or $200, whichever is lower), create an alert The key is resource-level granularity. Service-level costs might mask a spike in one VM because other VMs in the same service are stable. CCO tracks costs at the individual resource level — every VM, every database, every storage account — so nothing hides in the average. ## The alert workflow When an anomaly triggers: 1. **Alert created** — appears on the Alerts page with severity color coding (critical/high/medium/low) and a cost comparison grid showing baseline vs current with deviation percentage 2. **Email notification** — if configured, recipients get an email with the alert details and a "View in App" link 3. **Investigation** — click through to Cost Explorer, group by resource, filter to the subscription. The daily breakdown shows exactly when costs spiked 4. **Resolution** — fix the root cause in your cloud console, then mark the alert as resolved in CCO. The next detection cycle confirms costs have normalized Alerts that resolve themselves (costs return to baseline) are auto-resolved by the engine. No manual cleanup needed for transient spikes. ## Budget alerts: catching the slow creep Anomaly detection catches spikes. Budget alerts catch the gradual growth that's technically "normal" but will exceed your spending target: - **Actual spend thresholds** — alert when current spend crosses 80% (warning) or 100% (critical) of the budget amount - **Forecast thresholds** — alert when the projected month-end spend (daily rate × remaining days) would cross those thresholds - **Service-level budgets** — create a budget just for "Compute" costs within a subscription, using case-insensitive service name filtering Forecast alerts are the early warning system. On day 15 of the month, if your daily run rate projects a 120% budget overshoot by month-end, you get a forecast_critical alert — with 15 days to correct course instead of finding out after the fact. ## Configuring alert rules The Rules tab on the Alerts page lets you create detection rules per scope: - **Scope**: subscription, resource group, or individual resource - **Threshold type**: percentage (e.g., 50% spike) or absolute (e.g., $200 increase) - **Baseline window**: 7, 14, or 30 days - **Severity**: low, medium, high, or critical - **Cooldown**: minimum hours between alerts for the same scope (default 24h) - **Email notifications**: toggle + recipient list If you don't create any custom rules, the system defaults kick in — 50% spike or $200 absolute, whichever is lower. This means anomaly detection works out of the box with zero configuration. ## Real-world anomalies (from the demo) The demo environment includes deliberately injected anomalies you can investigate: - A VM that tripled in cost 2 days ago (accidental premium-tier resize) - A storage account with a 5x egress spike last week - A database that jumped 200% yesterday (tier upgrade) - A resource with gradual 40% cost creep over 2 weeks Each has a pre-triggered alert visible on the Alerts page — walk through the full investigation workflow in the [live demo](https://cco-demo.quantumitpartners.com). ## Kubernetes cost anomalies CCO also tracks Kubernetes costs at the namespace and node-pool level. The K8s recommendation engine detects: - **Idle namespaces** with minimal resource consumption - **Over-provisioned node pools** where capacity far exceeds utilization - **Spot/preemptible VM opportunities** for workloads that tolerate interruption These appear alongside VM and storage anomalies, tagged with `k8s_cluster` and `k8s_component` for easy filtering in Cost Explorer. ## The 4-hour feedback loop The combination of 4-hour cost refresh + anomaly detection + email notifications creates a tight feedback loop. A misconfigured resource that would run unchecked for weeks in a monthly-review workflow gets caught the same business day. That's the difference between a $200 mistake and a $6,000 surprise on the monthly bill.