Outcome and audience

For teams routing budget, anomaly, and cost-change signals to accountable recipients.

Before you begin

The workspace, membership, entitlement, connection, and selected alert scope must be active. External destinations must be configured separately.

Where to go

Open Alerts under Control, or choose Create scoped alert from an authorized cost view.

Complete the workflow

Keep the selected workspace, provider, period, currency, cost basis, and data-through date visible as you work.

  1. Choose the supported provider, connection, and canonical scope.
  2. Set the condition, threshold, evaluation window, and consecutive observations.
  3. Set a suppression window and recovery behavior.
  4. Choose in-app recipients and optional Slack or email destinations.
  5. Send test message or Send test email where permitted, then inspect each delivery state independently.

Interpret the result

Triggered and resolved events remain in the product. A Slack or email failure does not erase the event or imply another channel failed.

Loading, empty, partial, and unavailable states

Loading preserves the current scope. Empty means no records match the authorized scope. Partial or stale data keeps its completed-through boundary visible. Unavailable or permission-denied states explain the missing prerequisite and never substitute zero or another provider.

Provider differences

Signals and context follow provider dimensions and completed data; unsupported evidence cannot trigger a fabricated zero.

Synthetic example

Illustrative example · synthetic data Example: Northstar Labs alerts after two completed daily observations exceed USD 250, suppresses repeats for 24 hours, and sends separate Slack and email copies.

Common mistakes

Do not use a broad noisy scope, rely on email as the system of record, or resend a failed channel without checking suppression and recovery state.