Cost Anomaly Detection¶

🚨 Spending Spike Alert | Commands: runbooks finops cost-drops, runbooks finops detect-orphans

Overview¶

Detect month-over-month cost changes, spending anomalies, and new unexpected charges.

When to Use¶

Scenario	Command	Detection Capability
Daily Anomaly Monitoring	`runbooks finops dashboard --detect-anomalies`	Real-time spending spikes (>20% increase)
Monthly Cost Review	`runbooks finops cost-drops --all-profiles`	MoM reduction tracking and changes
Hidden Cost Hunting	`runbooks finops detect-orphans --all-profiles`	Unused resources + accidental charges

Usage Examples¶

Example 1: Cost Spike Detection (2 min)

runbooks finops dashboard \
  --all-profiles \
  --timeframe daily \
  --detect-anomalies

# Output:
# Alert: Prod Workload Account
#   - Daily cost: $412 (2026-05-20)
#   - Yesterday: $340
#   - Increase: 21% (+$72)
#   - Root cause: New EBS volume attached (unscheduled)
#   - Action: Investigate and optimize

Example 2: Month-over-Month Reduction Tracking (3 min)

runbooks finops cost-drops \
  --all-profiles \
  --format pdf

# Output: MoM trends:
# March to April 2026: $152K → $125K (-17.8% = -$27K/month)
# Root cause analysis:
#   - EC2 optimization: -$8K
#   - Decommissioned instances: -$12K
#   - Commitment discounts: -$7K

Example 3: Orphaned Resource Detection (5 min)

runbooks finops detect-orphans \
  --all-profiles \
  --output-dir ./orphan-audit

# Output: orphan-audit/findings.csv
# - 45 unattached EBS volumes: $180/month waste
# - 250+ orphaned snapshots: $500/month waste
# - 12 unused Load Balancers: $320/month waste
# Total hidden cost: $1000/month

Anomaly Types Detected¶

Type	Detection	Threshold	Example
Spending Spike	Daily cost > 120% of 7-day avg	>20% increase	New compute instance deployed
New Service	Service cost appears (was $0)	Any activation	First month of managed service
Account Explosion	Account cost increase	>50% increase	Runaway process or misconfiguration
Regional Surge	Region cost increase	>30% increase	Accidental multi-region replication
Tax/Discount Change	Effective rate variance	>5% change	Volume discount loss or new tax

dashboard - Daily monitoring (includes anomaly detection)
analyze-ec2 - Instance-level anomalies (underutilization)
validate-with-mcp - Accuracy check for detected anomalies

MCP Validation¶

Anomaly detection validated at ≥99.5% accuracy using statistical methods (7-day trend baseline).