Cost Anomaly Detection Overview
Cost Anomaly Detection finds resources whose Azure spend has changed unexpectedly. This page explains how StratoLens decides what counts as an anomaly, what the severity badges mean, and where to look in the product.
How Anomalies Are Flagged
StratoLens flags a resource when its daily cost diverges meaningfully from that resource's recent baseline. Each flagged anomaly carries one of two labels, driven entirely by direction:
- Cost Spike
- Cost went up. Shown with a 🔴 indicator on the anomaly card.
- Cost Drop
- Cost went down. Shown with a 🟢 indicator on the anomaly card. A resource that drops to $0 (a stopped or deleted resource, an expired reservation) appears as a Cost Drop.
Severity
Each anomaly is automatically classified as High, Medium, or Low based on how much the cost changed in both percent and absolute dollar terms. You don't set severity directly, you set the thresholds that determine whether an anomaly is reported at all (see Settings).
Severity drives the colored dot on the flat list view of the Anomalies page:
- 🔴 High
- A large change in both percent and dollars. Look at these first.
- 🟠 Medium
- A noticeable change. Worth a glance.
- 🟡 Low
- Above your thresholds, but the impact is small.
Direction
Every anomaly has a direction: Increase (cost went up, shown in red) or Decrease (cost went down, shown in green). Decreases are still anomalies because they often signal something worth knowing about, a stopped resource, a freed reservation, or a misconfiguration that left a system idle.
Filter by direction
If you only care about cost surprises, set the Direction filter on the Anomalies page to Increase. Switch to Decrease when you're looking for optimization wins or accidental shutdowns.
Analysis Window
The scanner always analyzes the last 90 days of cost history when identifying what's normal for a resource. This window is fixed and not user-configurable. You can narrow what's displayed on the Anomalies page using the Time Perioddropdown, but that doesn't change what the scanner looked at.
Recent days are excluded
Cost data is collected from Azure Cost Management. The most recent 1-2 days of cost data may be partial, so StratoLens excludes the current day from anomaly analysis to avoid false alarms from incomplete data.
Where to Find It
- Costs > Cost Anomalies
- The main investigation page. Drill from a subscription down to a single resource and inspect every anomaly StratoLens has detected. See Anomalies Explorer.
- Dashboard widget
- An at-a-glance view of recent anomaly activity, with the top 7 most significant changes. See Dashboard Widget.
- Settings > Scanner
- Tune detection sensitivity. See Settings.
Prerequisites
- Permissions
- A role with read access to cost data is required to view cost anomalies. Editing scanner thresholds additionally requires write access to scanner settings.
- Data
- At least one completed scan with cost data collected. On a brand-new install, anomalies appear after the first scan finishes.
Sparse anomalies on a new install
On a freshly installed environment, the anomalies list may be sparse or empty until enough cost history accumulates for the scanner to identify normal patterns. This is expected, accuracy improves once a few weeks of cost history have been collected.
One-time charges hidden by default
Reservation purchases, refunds, and Azure Marketplace charges are detected by the scanner but hidden by default on both the Anomalies page and the dashboard widget so the list stays signal-heavy. Uncheck Hide one-time charges if you specifically want to audit purchases.
Costs displayed in your Azure billing currency
Costs are shown in the Azure billing currency for each subscription (USD, EUR, GBP, etc.). Different subscriptions can be billed in different currencies.