Manage anomaly notifications

The anomaly detection engine is always running. You can set up notifications to receive near-real-time emails on detected anomalies, send messages to Slack or Microsoft Teams channels, or show alerts as in-app notifications in the DoiT console.

Tip

In addition to notifications, you can run CloudFlow flows automatically when cost anomaly events occur—for example when an anomaly is detected, when its status or cost changes, or when it is acknowledged. See DoiT Cloud Intelligence event trigger to set up a flow trigger.

Required permissions

• Users Manager, Anomalies Viewer, Cloud Analytics User

Cost anomaly notification settings

Cost anomaly notifications are managed together with other types of notifications.

To update the cost anomaly notification settings:

1. Sign in to the DoiT console, launch the Notifications page using either of the following methods:

   • Select the gear icon () from the top navigation mega menu, and then select Notifications.

   • On the Cost anomalies page, select Manage notifications from the Anomaly settings dropdown.

2. Follow the instructions to Create a new notification or edit an existing one.

3. In the step to select notifications, go to the Cloud cost anomalies section, and select the Cost anomaly detection checkbox.

4. Specify the notification conditions. You receive notifications only when all of the specified conditions are met.

   

Allocations

To receive anomaly notifications for an allocation, you must enable anomaly detection for that allocation. See Monitor cost anomalies for details. Allocations without anomaly detection enabled are excluded from the notification scope of the Cloud cost anomalies section.

You can specify whether to receive notifications from specific resource groups (defined by allocations).

• Include all enabled allocations: Default setting. Includes all allocations that have anomaly detection enabled.

• Include specific allocations: Receives notifications only from the scopes defined by the specified custom allocations. The allocation picker only displays allocations that have anomaly detection enabled.

  • With this option, you don't receive notifications for anomalies that occur in a broader (superset) or a narrower (subset) scope of that allocation.

  • To avoid missing critical cost anomaly notifications, we recommend keeping a general anomaly notification channel active.

• Exclude specific allocations: Receives no notifications from the scopes defined by the specified custom allocations. The allocation picker only displays allocations that have anomaly detection enabled.

A warning shows how many allocations are hidden when anomaly detection is enabled for some allocations and Include or Exclude filters are applied.

Severity and cost settings

These two options help you control the volume of notifications:

• Severity level: Sets the minimum severity level that will trigger the notification. There are three severity levels: Information, Warning, and Critical. By default, the severity level for email notifications is Critical.

• Costs threshold: Sets the minimum amount of the cost of anomaly that will trigger the notification. The threshold is the gap between your actual cost and the maximum cost in the normal range. You can't use decimals in this field.

If you want to reduce or increase the number of identified anomalies, consider adjusting the Anomaly sensitivity settings.

Resend notifications for active anomalies

By default, anomaly notifications are sent only upon initial detection. Because active anomalies can quickly drive up costs if left unattended, we recommend configuring renotification in case the cause of an anomaly is not addressed in time.

There are two types of renotification conditions:

• Time period (hours): Resends notifications at regular intervals (1 to 24 hours) as long as the anomaly remains active.

• Cost increase: Resends notifications if the maximum total cost of active points increases by a specified percentage, amount, or both, relative to the total cost at the time of detection.

  • Within (rolling window): Resends notifications only if the increase occurs within a specific timeframe.

  We evaluate updated cost data every hour, regardless of whether a renotification has been sent. At each evaluation point, the system compares the maximum total cost during the period to the total cost at the time of detection, and sends a notification if the threshold is crossed.

  When using the Within option, the system checks a sliding time window at each evaluation point. If a renotification is sent, that point becomes the start of a new window to prevent redundant notification.

  The example below will trigger a renotification if the cost increases by 50% or US$100 within 12 hours of the previous notification.