Anomaly Dashboard

This section guides you to configure the detection of cost anomalies in your cloud account using CoreStack.

Cost Anomaly Detection

The Cost Anomaly feature in CoreStack is used to detect any abnormal costs incurred in a cloud account. Anomalies can be detected if the daily spend is either too high or too low. Anomaly trends will be shared with users, who can take preventive actions accordingly.

A cost anomaly is detected through the billing data provided by the cloud provider. Anomalies identified through billing data take approximately 24 - 48 hours to identify depending on the cloud provider, since there is a wait time involved with billing data being shared by the cloud provider.

Users can view the following section for Cost Anomaly in CoreStack:

• Cost Anomaly (Billing) - Summary

After a cost anomaly is identified, an email notification is sent to the user as per the notification settings updated by them. The user can then take the required remediation steps from their end to manage their costs as per their preferences.

Cost Anomaly Logic

Refer to the logic or calculation given below that is used to detect cost anomaly:

• Daily Average Spend = Cloud Spend Average of last 30 days
• Lower Cost Spend Limit = (Daily Average Cost Spend - (Daily Average Cost Spend * (100-Sensitivity) %))
• Upper Cost Spend Limit = (Daily Average Cost Spend + (Daily Average Cost Spend * (100-Sensitivity) %))
• Expected Spend Range = Lower Cost Spend Limit to Upper Cost Spend Limit
• Sensitivity = The sensitivity parameter is the key to tuning the detection results. In general, a high sensitivity value means the model is more sensitive to outliers and is likely to identify more anomalies. A low sensitivity value usually means the model will tolerate minor outliers.
• Cost Impact = Cost Spend - Upper Cost Limit (if Cost Spend > Upper Cost Limit) or Lower Cost Limit - Cost Spend (If Cost Spend < Lower Cost Limit).

Cost Anomaly by Billing

There are different options available to view cost anomalies as per the available billing data. The Cost Anomaly (Billing) – Summary section displays the following graphs and bar charts:

• Cost Impact by Cloud Provider
• Cost Impact by Cloud Account
• Cost Impact by Product Category
• Cost Impact by Resource Category

Perform the following steps in CoreStack to view cost anomalies:

1. Click Cost > Cost Anomaly.
2. In the Tenant list, click to select a tenant.
3. In the Cloud Provider list, click to select an appropriate provider option.
4. In the Timeframe list, click to select the time period for which the cost anomaly needs to be viewed.
5. In the Currency list, click to select an appropriate currency.

The Total Cost Impact, Total Anomalies, and Cost Impact by Cloud Provider for the selected cloud account will be displayed. These details are based on the billing information provided by the cloud provider.

• Total Cost Impact: This shows the cost impact for multiple anomalies detected within a specific time period, and according to other filters chosen by the user.
• Total Anomalies: This shows the total number of anomalies identified.
• Cost Impact by Cloud Provider: This is a graph that shows the trend of cost impact within a set time period. For example, in the graph shown below, the cost impact trend for the month of March is displayed. Users can also see the cost impact amount for a particular date.

Users can also view detailed bar charts related to Cost Impact by Cloud Account, Cost Impact by Product Category, and Cost Impact by Resource Category. These bar charts are shown in descending order of cost impact – that is, the cloud account, product category, or resource category with the highest cost impact shows on the top and the one with lowest cost impact shows at the bottom.

📘

Note:

A user can click any of the blue horizontal bars, select the appropriate option from the drop-down list, and then view the change in the shown graph/charts.

6. On the Cost Impact by Cloud Provider graph, click any red dot (Cost Anomaly) to view more details. The Cost Anomaly – Root Cause section displays details about the root cause of an anomaly. User can also view the Cost Impact at Product & Resource Categories graph.
   In the Cost Impact at Product & Resource Categories graph, the product categories are listed on the left side and the resource categories are listed on the right side. A user can click any product category to view the list of resource categories related to it. Alternately, a user can click a resource category to view the product category mapped to it.

7. To view the Cost Impact at Product & Resource Categories chart for a specific cloud account, product category, or resource category, a user can select from the appropriate options in the following fields:
   • Cloud Account
   • Product Category
   • Resource Category
     The Cost Impact at Product & Resource Categories chart will be displayed as per the options selected.

Configuration for Cost Anomaly

Cost Anomaly settings can be configured at the tenant level. Users can modify the sensitivity number and set it as per their needs in order to help detect anomalies.

The sensitivity number is crucial in deciding the upper and lower spending limits.

• The daily average cost spend is derived by calculating the average cloud spend for the last 30 days.
• The upper spend limit is the average daily spend plus the set sensitivity value.
• The lower spend limit is the average daily spend minus the sensitivity value.

If the daily spend value goes above or below the upper and lower spend limit, then an anomaly is detected.

Perform the following steps to make configurations for the Cost Anomaly feature:

1. Navigate to the following path:
   • Tenant level: Settings > Tenants > Tenant > Cloud Account Settings > View Full Settings > Cost
2. Click to move the slider to right to enable Cost Anomaly at the tenant level.
3. Click Edit.

4. To edit the sensitivity number, click the pencil icon.
5. In the Sensitivity box, type the desired number if it needs to be changed.

By default, the sensitivity is set to 70. If you want to change the sensitivity number, then you can modify it.

Refer to the example shown below to understand how the cost anomaly feature works.
For a particular resource category, the cost/spend amount for at least 30 days is used to detect any cost anomalies. In the example shown below, each day has some cost which is used to detect cost anomalies. The cost anomalies detected through calculation are marked in red.

Notice how data points are marked in red and anomalies are detected once the sensitivity number changes. If the sensitivity entered by the user is 50, then it detects no anomalies. But at a sensitivity of 90, multiple anomalies are detected.

If users change the sensitivity number (shown in the yellow box), then the Cost Impact, Daily Average Cost Spend, Upper Cost Limit, and Lower Cost Limit will also change. This way, you can see how the change in sensitivity number contributes to the difference in cost anomaly detection.

Cost Anomaly – Email Notifications

Overview

In the CoreStack application, the email notification settings for cost anomalies can be done at the tenant level. An email notification is sent to users whenever a cost anomaly is detected – that is, when the cost spent value goes above or below the threshold value, then an anomaly is detected and an email notification is sent to users with all the relevant details.

The email notifications are sent within 24–48 hours of detection. Users can then take action accordingly based on the anomaly details provided to them.

📘

Note:

For GCP accounts, the notifications are sent within 6-24 hours and for other accounts, the notifications are sent between 24-48 hours.

Configuring Cost Anomaly Email Notifications

Perform the following steps to set up cost anomaly email notifications:

1. Navigate to the following path:
   • For Tenant level: Settings > Tenants > Tenants tab > select a tenant > Cloud Account Settings > View Full Settings > Cost tab > Cost Anomaly > select Email Address and Webhook, or any one option.
2. Click to move the slider to right to enable Cost Anomaly at tenant levels.
3. Click Edit.

4. Click to select Email Address and Webhook or either of these options.
5. In the Email Addresses box, type the relevant email addresses of the recipients.
6. In the Webhook box, type the URL of platforms where CoreStack integration is enabled.
7. Click SAVE & CLOSE.

📘

Note:

Refer to Cofiguration for Cost Anomaly procedure to know how to set sensitivity.

If an anomaly is detected, then a notification is sent to users. Refer to the sample notification email shown below. The anomaly details can be viewed in the email.

The email shows the date when the cost anomaly occurred, cost impact amount, cloud account type, cloud account name, cloud account ID, tenant name, product category, resource category, resource name (optional), daily average spend, expected spend range, cost spend, sensitivity percentage, etc.

Based on the cloud spend, four different types of notifications are sent:

• Cloud Spend Above Threshold (based on last 30 days daily average spend)
• Cloud Spend Below Threshold (based on last 30 days daily average spend)
• Cloud Spend Above Threshold (based on yesterday's spend)
• Cloud Spend Below Threshold (based on yesterday's spend)