Cost Anomaly Detection

CloudXper provides integrated cost anomaly detection services for three CSP companies.
Notifications are sent when the actual cost exceeds the threshold compared to the AI-predicted cost. The threshold dynamically adjusts based on the configured sensitivity level.
Detection is done on the date all cost data is collected, so it usually takes about 2 to 3 days.
When detection occurs, you can receive a notification email to the email address you specify.
All detected records are saved in detection history.

1. Cost Anomaly Detection

1.1. Cost Anomaly Detection Summaries

Cost Analysis ▶ Click the Cost Anomaly Detection menu to Go to Cost Anomaly Detection.

If there is no registered detection monitor and no detection history, nothing will be viewed.
To detect cost anomalies, specify the target (account) to be detected. detection monitor You must register again.
Detection monitor registration is at the bottom. detection monitor See the entry.

1.1.1.Cost anomaly detection summary card description

Target Month

Currency Switch

Detected Anomalies : It shows the number of anomalies detected by detector you registered.

Excess Cost: It shows the exceeded cost comparing actual spends and expected spends for the accounts which is detected as an anomaly.

Even if one account is registered with two or more detection monitors, over-spends for that account are added by once.

Total Spends: It shows the total spends for the accounts which is detected as an anomaly.

Compared to previous month: It shows the total spends for the accounts which is detected as an anomaly compared to the previous month.

1.2. Detection Monitors

Click the Detection Monitor tab to go to the Discovery Monitor.

Click +Create a new monitor to display the new monitor registration screen.

Select CostGuard Advanced for Monitoring service type .

CostGuard is a notification service that related to CloudXper costs.

Enter a monitor name.

Set a certain sensitivity for the detection monitor.

The higher sensitivity, the more sensitive for detecting even small anomalies.
The lower sensitivity, the less sensitive for detecting for big anomalies.

Hover your mouse cursor over the question mark icon to view image descriptions for each selected sensitivity.

Click Next after selecting target to detect.

You can select Detection targets in following orders. (Company > Service > Cloud Account)
If you select a company, detection monitor will detect for all services and cloud accounts belongs to the company.

Enter channels which you want to receive from.

You can get notifications through two channels. (Email and Slack)
Users registering the monitor will receive notifications by default.
If you don’t enter additional email addresses, you are the only user will receive notifications.

Click Add after checking all you entered, you can see that a new detection monitor has been created as follows.

Detection Monitor begins the day after registration.
If anomalies are detected, an email will be sent.
You can check anomaly detection details in Detection Record.

1.2.1.Edit Detection Monitor

You can see editing screen when clicking the name of the detection monitor.

1.2.2.Delete Detection Monitor

You can delete detection monitors in following orders.

Check the detection monitor you want to delete.

Click the delete button on the right.

1.2.3.Change Status

There is a status change button on the right side of the detection monitor whose status you want to change. You can change the status by clicking the corresponding button.

1.3. Detection Record

1.3.1. Column Description

Detection date: The date the anomalies were detected.

Severity: Divided into two levels of severity depending on the level of deviation from the prediction interval.

Severity is not determined by the absolute cost difference, but is determined by the AI model.
Therefore, in the case of cloud accounts with small cost increases or decreases, even small cost differences can be classified as 'serious'.

Detected property: Indicates the account for which an abnormality has been detected among accounts registered in the corresponding detection monitor.

Cost incurred: Indicates the actual cost incurred in the account where an abnormality was detected.

Estimated cost: Indicates the predicted cost of the account where an abnormality was detected.

Exceeded Cost: Indicates how much the actual cost incurred in the account where the anomaly was detected exceeded the predicted cost. (difference between incurred costs and expected costs)

Excess rate: Expresses the excess cost as a percentage.

1.3.2.Detection Record Details

Select one of the detection records and click on it.

You can check the details of the detection records on the right.

1.3.2.1. Detection record detailed information on each area

Basic Information

Indicates basic information of the detected history.
You can find out the incurred and expected costs, detection date, severity, etc.

potential root cause

Indicates which cloud resources are thought to be the root cause of more than just cost.
In some cases, a potential root cause may not be found.
Additionally, a potential root cause is a predicted cause and may not be the root cause of more than the actual cost.

cost trend

You can see cost trends for potential root causes.
If you select a future date, you can see predicted costs for your account, but we do not support predicted costs for cloud resources.

1.3.2.2.Potential root cause

Cloud Resources: Cloud resources predicted as potential root causes. Cost anomalies are only detected on-demand, so only used resources are detected.

Cost incurred: This is the cost incurred for the resource.

Compared to the previous day: Shows the increase or decrease as a percentage compared to the previous day. Even if there is no or small cost difference from the previous day, it can be detected as a potential root cause.

1.3.2.3.Chart type

1.3.2.3.1.Bar chart

Select Bar Chart.

A bar chart plots cost trends for an account and its potential root causes.
Only one row can be selected from the Potential Root Cause table.
The chart reloads based on the row selected in the Potential Root Cause table.

Indicates the cloud resource for the selected row in the Potential Root Cause table.

Indicates the account for the selected row in the Potential Root Cause table.

1.3.2.3.2.Line chart

Select a line chart.

The line chart represents cloud resource cost trends for the selected row in the Potential Root Causes table.
You can select multiple rows in the Potential Root Causes table to view cost trends for those resources at once.

Represents a cloud resource in the Potential Root Cause table.

1.3.2.3.3.Time series chart

If you select a date in the future, predictive cost will be activated with the following message:

Account Filter: A list of accounts with detected abnormalities appears.

Detected date tag: Displays a tag on the date the abnormality was detected.

Legend: Indicates the selected account and its prediction interval.

Pressing the line chart or bar chart button turns off the forecast cost view.