Outcome and audience

For FinOps, platform, and service owners investigating unexpected spend.

Before you begin

The selected provider needs completed comparison data and enough source-backed dimensions to explain the change.

Where to go

Open Anomalies under Control, or follow anomaly context from Overview.

Complete the workflow

Keep the selected workspace, provider, period, currency, cost basis, and data-through date visible as you work.

  1. Confirm provider, period, comparison, currency, and completeness.
  2. Review severity and financial impact.
  3. Inspect the supplied contributing project, service, resource, tag, model, or workspace dimensions.
  4. Record notes, assign an owner, and set the investigation status.

Interpret the result

Severity prioritizes financial review. It is not operational telemetry, and deterministic billing evidence can still be incomplete or corrected.

Loading, empty, partial, and unavailable states

Loading preserves the current scope. Empty means no records match the authorized scope. Partial or stale data keeps its completed-through boundary visible. Unavailable or permission-denied states explain the missing prerequisite and never substitute zero or another provider.

Provider differences

Contributors depend on the source dimensions and coverage available for that provider.

Synthetic example

Illustrative example · synthetic data Example: Northstar Labs records a synthetic USD 4,200 AWS service increase, assigns the platform owner, and marks it investigating.

Common mistakes

Do not declare an incident from billing data alone or infer an unavailable contributor.