> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oncost.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Anomaly Detection

> How oncost detects unusual spending patterns

# Anomaly Detection

oncost automatically detects unusual spending patterns and surfaces them in your Home Feed.

## How it works

After each data collection, oncost compares recent spend against historical baselines per service. When spend deviates significantly from the expected range, an anomaly is created.

Anomalies are classified by severity:

| Severity | Meaning                                                   |
| -------- | --------------------------------------------------------- |
| Critical | Spend is far above baseline -- immediate attention needed |
| Warning  | Spend is above normal range -- worth investigating        |
| Info     | Notable change but within acceptable bounds               |

## Investigating anomalies

From the Home Feed, each anomaly card shows:

* **Service** and **provider** affected
* **Baseline** vs. **actual** spend
* **Summary** of what changed

Click **Investigate** to open the Cost Explorer pre-filtered to that service and date range. This lets you drill into which region, account, or resource caused the spike.

## Managing anomalies

* **Acknowledge** -- mark the anomaly as seen (removes from active feed, keeps in history)
* **Dismiss** -- mark as false positive (won't re-alert for similar patterns)

Both actions update immediately in the feed.

## Anomalies in notifications

Anomalies are included in:

* **Slack alerts** -- real-time notification when a critical anomaly is detected
* **Weekly digest** -- unresolved anomaly count included in the summary