Manage anomaly notifications

The anomaly detection engine is always running. You can set up notifications to receive near-real-time emails on detected anomalies, send messages to Slack or Microsoft Teams channels, or show alerts as in-app notifications in the DoiT console.

Required permissions

• Users Manager, Anomalies Viewer, Cloud Analytics User

Cost anomaly notification settings

Cost anomaly notifications are managed together with other types of notifications.

To update the cost anomaly notification settings:

1. Sign in to the DoiT console, launch the Notifications page using either of the following methods:

   • Select the gear icon () from the top navigation mega menu, and then select Notifications.

   • On the Cost anomalies page, select Manage notifications from the Anomaly settings dropdown.

2. Follow the instructions to Create a new notification or edit an existing one.

3. In the step to select notifications, go to the Cloud cost anomalies section, and select the Cost anomaly detection checkbox.

4. Specify the notification conditions. You receive notifications only when all of the specified conditions are met.

   

Allocations

You can specify whether to receive notifications from specific resource groups (defined by allocations).

• Include all allocations: Default setting.

• Include specific allocations: Receives notifications only from the scopes defined by the specified custom allocations.

  • With this option, you don't receive notifications for anomalies that occur in a broader (superset) or a narrower (subset) scope of that allocation.

  • To avoid missing critical cost anomaly notifications, we recommend keeping a general anomaly notification channel active.

• Exclude specific allocations: Receives no notifications from the scopes defined by the specified custom allocations.

To use the Include or Exclude option, you must first enable anomaly detection on the relevant custom allocations. See Monitor cost anomalies for details.

Severity and cost settings

These two options help you control the volume of notifications:

• Severity level: Sets the minimum severity level that will trigger the notification. There are three severity levels: Information, Warning, and Critical. By default, the severity level for email notifications is Critical.

• Costs threshold: Sets the minimum amount of the cost of anomaly that will trigger the notification. The threshold is the gap between your actual cost and the maximum cost in the normal range. You can't use decimals in this field.

If you want to reduce or increase the number of identified anomalies, consider adjusting the Anomaly sensitivity settings.

Resend notifications for active anomalies

By default, anomaly notifications are sent only upon initial detection. Because active anomalies can quickly drive up costs if left unattended, we recommend configuring renotification in case the cause of an anomaly is not addressed in time.

There are two types of renotification conditions:

• Time period (hours): Resends notifications at regular intervals (1 to 24 hours) as long as the anomaly remains active.

• Cost increase: Resends notifications if the maximum total cost of active points increases by a specified percentage, amount, or both, relative to the total cost at the time of detection.

  • Within (rolling window): Resends notifications only if the increase occurs within a specific timeframe.

  We evaluate updated cost data every hour, regardless of whether a renotification has been sent. At each evaluation point, the system compares the maximum total cost during the period to the total cost at the time of detection, and sends a notification if the threshold is crossed.

  When using the Within option, the system checks a sliding time window at each evaluation point. If a renotification is sent, that point becomes the start of a new window to prevent redundant notification.

  The example below will trigger a renotification if the cost increases by 50% or US$100 within 12 hours of the previous notification.