Anomaly Detection: Understanding Metrics and Viewing your Anomalies – Cloud Cost

Anodot Cost monitors cost metrics and identifies anomalies from your cost metrics’ normal behavior patterns, as learned through Anodot’s patented algorithms.

The anomaly algorithm runs on a daily basis, processing up to 4 previous months of cost data.
Anodot currently presents anomalies with impact >=50$ in order to reduce the noise.
For MSPs and their customers, the anomaly algorithm is invoked after each re-billing process.

This article includes:

Understanding Metrics
Viewing your Anomalies

Understanding Metrics

The cost anomaly engine processes a predefined set of cost metrics and these are optimized and set in order to reduce the noise and automatically create added-value anomaly insights.

Note: Anodot algorithm filters in 'On demand' anomalies and these are presented in the Anomaly detection monitoring UI.

The list of predefined metrics is listed in the following table:

Cloud Provider	Customer Type	Metrics	Dimensions
AWS	Direct customers	Amortize cost	Linked Account (Account name) Service Purchase Option Usage type
Azure	Direct customers	Actual/Amortize Depending on the invoice exported metric	Cost Center Subscription (Account name) Service Purchase Option Usage type
GCP	Direct customers	Unblended cost/Amortize Depending on the invoice exported metric	Cost Center Project (Account name) Service Purchase Option Usage type
AWS	MSP Users	Amortize cost	Customer Name Linked Account (Account name) Service Purchase Option Usage type
Azure	MSP Users	Actual/Amortize Depending on the invoice exported metric	Customer Name Subscription (Account name) Service Purchase Option Usage type
GCP	MSP Users	Unblended cost/Amortize Depending on the invoice exported metric	Customer Name Project (Account name) Service Purchase Option Usage type
AWS	MSP Customers Dedicated account	Amortize cost	Linked Account (Account name) Service Purchase Option Usage type
AWS	MSP Customers Shared account	Unblended cost	Linked Account (Account name) Service Purchase Option Usage type
Azure	MSP customers	Actual/Amortize Depending on the invoice exported metric	Subscription (Account name) Service Purchase Option Usage type
GCP	MSP customers	Unblended cost/Amortize Depending on the invoice exported metric	Project (Account name) Service Purchase Option Usage type

Viewing your Anomalies

From the left menu navigate to Monitoring > Anomaly Detection
There are two main views for the anomalies:
- The All anomalies tab - the central repository for all anomalies. displays all the anomalies with at least a 50$ cost impact. The tab lists the top 200 anomalies. You can also use the search bar to search for values across all the anomaly table fields.
- The Alerts tab - all the anomalies that were triggered according to the defined alert rule
The numbers "All anomalies" numbers refer to the open anomalies.

For each anomaly, you can see a detailed chart depicting anomaly behavior patterns and explanations pinpointing the primary parameters driving these anomalies.
In addition, you can add a comment, feedback and mark each anomaly as resolved/ acknowledged.
The feedback is analyzed (mainly the NOT-INTERESTING feedback) to see how the Alert can be improved. This is where Anodot's machine-learning capability comes into place.

Anomaly detection cubelet

We provide anomaly root cause analysis aka cubelet by analyzing each underlying metric, looking only for the dimensions having anomalies during the same period, and covering at least 70% of the original anomaly impact.

Anomalies/Alerts Table

You can also define a time range to explore anomalies for a given period of time.

The various columns and fields in the All anomalies tab are described below:

Anomaly start time: The time at which the anomaly started.
Customer: (Displayed for MSPs) The customer to whom the linked account belongs.
Cost center: (Displayed for direct customers) The cost center to which the linked account is assigned.
Account name: Account Name (ID), mapped from the Linked account / Subscription / Projected.
Service: Cloud provider service.
Region: Cloud provider region.
Usage type: From one of Byte, Hours, Requests, Resource quantity, or Other.
Cost impact: Represents the delta between the anomalous data point and the previous normal value, in $ value.
Note: The anomaly cost impact is accumulated throughout the anomaly duration.
For example, if an anomaly lasted for 2 days, on day 1 the anomaly cost impact was 50$, and on day 2 the anomaly cost impact increased by 100$, which means that the accumulated anomaly impact is 150$.