Anomaly Detection: Defining Alerts

Anodot Cost enables you to create customized alerts according to your criteria. This article describes how to set up and manage these alerts.

• How to define an alert
• Viewing and managing alerts

How to define an alert

To create a new alert

1. From the Navigation Panel, click Monitoring > Anomaly Detection. Then click the All anomalies tab.
2. Click Alert configuration, and in the displayed popup, select + New Alert.
   
   
   
   The New Alert Rule dialog is displayed, as shown below:
   
   
   
3. Define the following:
   • In the Alert Rule Name field, set the name for the alert.
   • In the Direction field, set the direction in which the alert should be triggered: select Spike or Drop. 
   • Enter either Min. Cost Impact ($) amount, the Min. Cost delta (%) amount, or both.
     The Min. Cost impact ($) represents the delta between the anomalous data point and the previous normal value, in $ value, whereas the Min. Cost delta (%) represents the same delta in % value.
   • The alert doesn’t have to be specific to the account or service. If you want to receive an alert according to a set of service/linked accounts, configure the following:
     
     • Cost Center (Direct) / Customer (MSP) - select the Cost Center/Customer, and their associated linked accounts will be available for selection.
     • Linked Account / Subscription / Project - select the accounts to be alerted.
       
       Note: The OR condition between the Cost Center / Customer and the Linked Account / Subscription / Project fields signifies that a combination of Cost Center/Customer and accounts not associated with them can be selected in the Linked Account/Subscription/Project dropdown list.
       
       
     • Service - select the list of services that be alerted. Note the AND condition between the Cost Center/Customer, and Linked Account/Subscription/Project selection to the service.
       
   • In the Recipients field, add the email address of the alert recipients. Click My Email to add your email automatically.
     
4. Click Save. 

Viewing and managing alerts

When accessing the All Anomalies tab, you can see how many alerts are currently configured. The Alert configuration button shows the current number of alerts defined, as shown below:

To view the current list of alerts

1. Click the Alert configuration button and in the displayed popup, select Alert Rules List. The list of current Alert Rules is displayed.
   
   
   
   
2. (Optional) Click a column header to sort the alerts according to the selected column.
3. Click on a row to view the summary of the Alert Rule (as shown above).
4. You can also edit or delete the Alert Rule, as well as create a new Alert Rule:
   • To edit an Alert Rule, click . The Edit Alert Rule dialog is displayed. For more information about the various editable fields, see How to define an alert.
   • To delete an Alert Rule, click . In the displayed confirmation message, click Delete.
     Note that clicking Delete will also delete any open alerts under this Alert Rule. 
   • To create a new Alert Rule, click + New Alert. For more information, see How to define an alert.

Alert email notification

1. Once an alert rule is configured, the 'Anomaly Detection' notification property will be automatically enabled.
2. In order to disable the alert notification emails delete the alert rule itself.

Viewing your Alerts

1. From the left menu, navigate to Monitoring > Anomaly Detection
2. Choose the Alerts tab - which lists the top 200 anomalies. You can also use the search bar to search for values across all the anomaly alert table fields.

For each anomaly, you can see a detailed chart depicting anomaly behavior patterns and explanations pinpointing the primary parameters driving these anomalies.

You can also define a time range to explore anomalies for a given period of time.

The various columns and fields in the Alerts tab are described below:

• Anomaly start time: The time at which the anomaly started.
• Alert start time: The time at which the anomaly started.
• Alert Name: The time at which the anomaly started.
• Customer: (Displayed for MSPs) The customer to whom the linked account belongs.
• Cost center: (Displayed for direct customers) The cost center to which the linked account is assigned. In case the user didn't associate the account with the cost center the field will state 'Cost center wasn’t defined'.
• Account name: Account Name (ID), mapped from the Linked account / Subscription / Projected.
• Service: Cloud provider service.
• Region: Cloud provider region.
• Usage type: From one of Byte, Hours, Requests, Resource quantity, or Other.
• Cost impact: Represents the delta between the anomalous data point and the previous normal value, in $ value.
• Cost delta %: Represents the delta between the anomalous data point and the previous normal value, in % value.

The following icons are displayed in the far right of the anomalies table:

	Indicates if the alert is open. Indicates if the alert is closed.
	Indicates if the anomaly has an open alert (hover over the icon to see the name of the alert rule that has triggered the open alert). Indicates the anomaly has no open alerts.
	Click to investigate the anomaly using the Cost & Usage Explorer. The trend chart time range is 3 months back from the anomaly start time.

 

Download all alerts

You can download all your alerts (open and closed) into a CSV file.

 

 

Alert trigger

Alerts will be triggered to an email notification one day after the anomaly was detected (which means two days from the data processing).

 

Alert email notification:

An Anomaly alert will be sent once the alert was configured with an email recipient.

• Direct customers: The alert email will include the top 5 anomalies for this account, separated by cost center if one was configured.
• MSP: The alert email will include the top 5 anomalies for this account separated by customer.

	Open the anomaly detection alert page to view all existing alerts without filtering.
	Open the Cost & Usage explorer to explore the anomaly, the trend line is present 3 months back from the anomaly start time.
	Open the anomaly detection alert page to view all existing alerts corresponding to the email population and filtering such as time, cost center, and customer.

 

Slack notification :

 

MS-Teams notification: