Domain 1 · Understand Usage and Cost
Caught the day it happens, not month-end.
Anomaly Management is the difference between a five-figure surprise and a Slack thread that closes by lunch. CloudMonitor detects anomalies daily at the resource level, baselines them with a Bayesian model, and routes each one to the owner the cost group already knows about.
The problem
Anomalies that show up at month-end.
Monthly review, too late.
A misconfigured test cluster running for twenty-eight days is a budget hit, not an incident. By the time anyone notices, the money is gone.
Threshold alerts on every line.
A 20% threshold fires on every weekend batch job and every quarter-end backup. Practitioners learn to mute the channel.
Alerts with no owner.
The platform team gets paged for a spike on someone else's workload. Triage costs more than the anomaly.
How CloudMonitor answers
Daily detection, owner-routed, signal not noise.
Daily resource-level detection.
Every resource is checked daily against its own history. A spike on a single VM surfaces before it compounds into a weekly report line.
Bayesian baselining.
Weekly cycles, monthly closes, and quarter-end batch are learned, not flagged. The alert that fires is the one worth investigating.
Owner-routed via cost group.
The same allocation tree that runs invoices also routes anomalies. Each one lands with the team that owns the workload, not a central queue.
Teams plus webhook fabric.
Post to a Teams channel, raise a Jira issue, open a ServiceNow ticket — all from the same alert, no glue code to maintain.
Outcomes
Anomalies caught when they're cheap.
Daily
Resource-level detection
Owner
Routed via cost group, not central queue
Signal
Bayesian baseline, not threshold spam
Related Capabilities
More in the Understand Usage and Cost Domain.
Reporting and Analytics
30+ pre-built reports, tunable per audience.
Allocation
Cost groups, virtual tags, and shared-cost splits without renaming a single Azure resource.
All Understand Usage and Cost Capabilities
See every Capability in this Domain side by side.
Anomaly detection in CloudMonitor
From detection to routed alert.
Detect
Severity-tiered anomalies, not raw noise.
CloudMonitor forecasts daily spend per resource and flags the divergences — tiered by severity so the team triages the critical ones first.
Route
From detection to the owner, automatically.
Each anomaly carries its cost group and owner, then routes to Teams, Jira, or ServiceNow — so the right person sees it in hours, not at month-end.
Ask Finn
Move from detection to investigation.
The anomaly identifies the signal. Ask Finn assembles the likely drivers, evidence, and next check without changing the underlying resource.
For August 18–21, why did ML and AI spend exceed its baseline in AI Platform using billed cost? Rank the likely drivers.
What should the owner verify before deciding whether to act?
Add the period, cost group, and selected cost basis.
Source: this page interprets the Understand Usage and Cost domain published by the FinOps Foundation, licensed under CC BY 4.0. The wording, examples, and product mapping on this page are CloudMonitor’s own.
See an anomaly land in Teams, owner-attached.
CloudMonitor detects anomalies in your spend and routes each one end to end.
