Anomaly detection uses an AI algorithm to monitor your cloud spending and flag unusual cost fluctuations automatically. When an anomaly is detected, the system sends an alert so you can investigate and act before costs escalate.
Anomaly detection is a free service provided "as-is" using algorithms to identify suspected usage anomalies. By using this feature, you acknowledge that detection may be inaccurate, incomplete, or delayed. Alibaba Cloud does not guarantee 100% stability and is not liable for any financial losses resulting from undetected anomalies or false alerts.
Enable anomaly detection
On the Anomaly Detection page, toggle Enable Detection.
Detection results are available the next day. Results appear in the Anomaly Details list only when an anomaly is found.
A management account can view anomaly detection results for member accounts within its organization, one member account at a time.
Enabling detection or alerts applies only to the currently logged-in account. To use this feature for multiple accounts in an enterprise organization, enable it separately for each account.
Supported services
Adjust detection sensitivity
Click Detection Settings and drag the slider to set your preferred sensitivity level. A higher sensitivity narrows the threshold, making the system more likely to flag anomalies.
Two key concepts govern how detection works:
Threshold: The range of normal cost fluctuations, calculated from your sensitivity setting and historical spending data. The shaded blue area in the cost trend chart represents this range. If actual costs fall within the threshold, the system treats the fluctuation as normal. If costs exceed the upper or lower bound, the system flags it as an anomaly.
Cost impact: The absolute difference between the actual cost and the nearest threshold boundary. A larger cost impact means the anomaly is further outside the expected range.
Configure anomaly alerts
Toggle Enable Alerting to activate alerts. When a detected cost impact or severity level meets your configured threshold, the system sends an alert notification automatically.
Click Set Alert Threshold to configure alert conditions and notification methods.
Choose an alert condition
Select one of the following Alert Condition options:
Cost Impact: Enter a specific dollar amount. An alert fires when the cost impact exceeds this amount.
Severity: Select a severity level—Minor, Major, Critical, or Very Critical. An alert fires when the detected severity meets or exceeds your selection.
Severity levels
Severity is determined by cost impact relative to the threshold boundary.
Upward cost trend
| Severity | Condition |
|---|---|
| Minor | Cost impact ≤ USD 20, or cost impact ≤ 20% of the upper bound |
| Major | Cost impact > USD 20, and 20% of upper bound < cost impact ≤ 100% of upper bound |
| Critical | Cost impact > USD 20, and 100% of upper bound < cost impact ≤ 500% of upper bound |
| Very Critical | Cost impact > USD 20, and cost impact > 500% of upper bound |
Downward cost trend
| Severity | Condition |
|---|---|
| Minor | Cost impact ≤ USD 20, or cost impact ≤ 30% of the lower bound |
| Major | Cost impact > USD 20, and 30% of lower bound < cost impact ≤ 80% of lower bound |
| Critical | Cost impact > USD 20, and cost impact > 80% of lower bound |
| Very Critical | Not applicable |
Enable early alerts for critical anomalies
Enable this option to receive alerts for Critical and Very Critical anomalies as soon as 9 hours after the spending occurs—rather than waiting until the next day.
Early alerts increase notification frequency. If you find the volume disruptive, disable this option or reduce the number of recipients. You cannot view anomaly details on the same day they are detected; the details page is available the following day.
Evaluate detection results
When an anomaly is detected, it appears in the Anomaly Details list.
In the Actions column, click View Details to see the detection time, affected product and account, and cost trend before and after the anomaly. On any anomaly point in the chart, click View Cost Analysis to open the Cost Analysis page and verify the result.
Provide feedback
Feedback trains the detection algorithm—more feedback leads to more accurate results. For each detected anomaly, select one of the following:
Accurate anomaly: Confirms the anomaly reflects a genuine business issue. The system continues to flag similar patterns.
Non-issue: Indicates the cost fluctuation was expected or had minimal impact.
False positive: Indicates the detection was incorrect and no real anomaly occurred.
