Cost Anomaly

Unexpected changes in your cloud costs can quickly spiral into larger issues. The Anomaly Detection feature in OneLens keeps an eye on your spend trends and flags unusual patterns—so you don’t have to. Whether it's a sharp spike or a subtle drift, you'll know about it fast and have the tools to investigate and act.

Detecting Cost Anomalies

OneLens constantly analyzes your cost data using advanced modeling techniques. You don’t need to set it up or tune the models—detection happens automatically in the background.

How It Works

OneLens detects anomalies by extracting time series data from your cloud cost trends and running it through an advanced auto-regressive statistical model. This approach allows OneLens to identify unusual spikes or drops in cost by comparing actual values against predicted baselines, flagging only meaningful deviations as anomalies.

Viewing Cost Anomalies

Choosing An Anomaly

To view the list of anomalies, go to the Cost Watcher page from the sidebar.

View Options

On the top right, you have two ways to explore anomalies:

1. Anomalies by Account

2. Anomalies by Cost Centers

Time Range Filter

You can also set a custom time range to focus on a specific analysis window.

Anomalies List

Choose an anomaly to view its detailed breakdown.

Understanding an Anomaly

Clicking into an anomaly opens a detailed view with the following components:

Number References

1. Cost Trend Graph

• Visualizes cost behavior before, during, and after the anomaly.

2. Time Range

• Switch between 7-day or 14-day views to analyze the timeframe around the anomaly.

3. Anomaly Cost Impact Panel

• Highlights how much the actual cost deviated from the expected cost, along with the delta.

4. Chart Presentation Options

• Change how you view the anomaly graph:

  • Bar Chart

  • Filled Area Chart

  • Full Screen View

5. Anomaly Location Panel

• Shows the account, service, and region where the anomaly occurred.

6. Group By Options

• Choose how to group data in the table and chart:

  • Usage Type → Resource

  • Resource → Usage Type

7. Anomalous Resources Cost Trend Graph

• Displays the trend for each impacted resource to help you trace the cost change.

8. Resource/Usage Type Table

• Tabular breakdown of affected resources and usage types with associated cost and usage metrics.

9. Data Display Options

• Each row in the table includes a display toggle. Use it to highlight that data in the graph and visually isolate specific cost patterns.

Cost Metric Behavior

To help you interpret what’s happening, OneLens tags each anomaly with a Cost Metric Behavior label. This tells you how the affected metric behaved leading up to the anomaly:

• Trending Up/Down

  • A consistent increase or decrease in cost over time.

  • Ex: An increase in data storage costs due to a growing database size over several months.

• Seasonal

  • A pattern that repeats (like month-end processing or weekly dev bursts).

  • Ex: Higher compute costs during the end-of-quarter reporting period, occurring every 3 months.

• Volatile

  • Cost data that swings unpredictably with no stable trend.

  • Ex: (to be added)

• Others

  • No clear pattern, indicating a sudden or isolated spike.

  • Ex: A service having intermittent uses throughout the year.

Finding the Root Cause

OneLens pinpoint the factors behind the cost changes and provides detailed insights into the detected anomalies.

Resource Analysis

You can see exactly which resources are responsible for the cost change and how many are involved. This helps you quickly pinpoint the parts of your infrastructure that need attention.

Usage Type Analysis

You’ll get a breakdown of the usage type—like compute, storage, or data transfer—that triggered the anomaly. OneLens shows how much the usage deviated from expected levels, helping you understand the scale of the impact.

AI-Generated Hint

Once the data is collected, OneLens uses AI to generate a simple, plain-English explanation of the likely cause. These hints guide your investigation and keep things easy to understand. Your data stays safe—no third-party storage is involved.

Acting on Anomalies

Once an anomaly is identified, you decide what to do next. From the anomaly view, you can:

1. Acknowledge – Confirm that you’re aware of the anomaly.

2. Document – Add notes or details for future reference.

3. Assign – Send the anomaly to the right person or team.

4. Dismiss – Mark it as not actionable or irrelevant.

5. Resolve – Close the loop once action is taken.

Each action helps keep your anomaly management organized and trackable.

Setting Detection Sensitivity

You can adjust how aggressive the anomaly engine is when flagging changes:

1. Low Sensitivity – Only flags major shifts or spikes.

2. Medium Sensitivity – Balanced detection (recommended).

3. High Sensitivity – Detects even minor deflections in cost.

Choose the level that matches your risk appetite and operational noise tolerance.

Defining Anomaly Thresholds

Not every cost fluctuation needs to be flagged. You can fine-tune detection by setting minimum thresholds based on:

1. Dollar Threshold – e.g., trigger anomalies only when the cost change is more than $100.

2. Percentage Threshold – e.g., detect only if the change exceeds 15%.

Depending on how you want anomalies to be picked up, OneLens supports two threshold modes:

Dollar AND Percentage

• An anomaly will only be flagged if both conditions are met:

• Example: Cost must increase by at least $100 and by more than 15%.

Dollar OR Percentage

• An anomaly will be flagged if either condition is met:

• Example: Cost increases by $100 or more, or the percentage increase exceeds 15%—whichever comes first.