Cost anomaly detection
Seasonal baselines that understand weekly rhythm, ranked contributors, a review workflow, and why warming-up is reported instead of guessed.
Anomaly detection tells you when daily spend departed from its own normal, and what drove it.
How detection works #
Flux compares each day against a matching-weekday baseline — a Tuesday is compared against recent Tuesdays, not against the weekend.
The baseline uses median and MAD (median absolute deviation) rather than mean and standard deviation. Both are robust to outliers, which matters because the thing you are detecting is an outlier: with a mean, one spike inflates the baseline and hides the next one.
A day is flagged when it departs from the baseline by more than a governed multiple of the MAD, with the resulting robust score reported alongside the finding.
Warming up #
Until there is enough matching-weekday history, findings are reported as warming up rather than as anomalies.
This is a feature. A detector with three data points can produce a confident number, and that number is worthless. Flux prefers to say it does not know yet.
Scopes #
Detection runs at three levels, because the useful altitude differs:
| Scope | Answers |
|---|---|
| Subscription | Which part of the estate moved |
| Service | Which service drove it |
| Resource | Which specific thing |
Contributors #
Opening a finding ranks the services and resources that contributed, by absolute change. This is the difference between “spend rose 22%” and “this cluster rose by $4,100 and everything else was flat.”
Where charge-level billing data is available, contributor analysis reaches down to meters and pricing categories — enough to distinguish a usage increase from a rate change.
Review workflow #
Findings carry a status: new, investigating, acknowledged, or resolved, with a note and who set it.
This exists so the same spike is not re-investigated by three people across two weeks. A resolved anomaly keeps its evidence and stays queryable.
Evidence packs #
Any finding exports as a deterministic evidence pack containing the observed values, the baseline and method version, the contributors, the coverage state, and the uncertainty.
The point is reproducibility: someone who was not in the room can follow how the conclusion was reached, and get the same answer.