Cost anomaly alerts

Cost anomaly alerts watch your daily AWS spend per service and flag sudden spikes that may indicate a misconfiguration, runaway resource, or unexpected usage. Unlike monitoring alerts (which fire after a waste scan), anomaly alerts run every morning against yesterday's Cost Explorer data.

What gets detected

Parsivex compares each AWS service's spend on a given day to its recent normal range. Anomalies are raised per service — for example, Amazon EC2, Amazon S3, or Amazon RDS — plus a Total AWS spend row that sums across services.

A spike is flagged only when both of these are true:

1. Spend jumped relative to baseline — at least 2× for a warning, or 4× for critical severity
2. The dollar increase is meaningful — at least $5/day above baseline for a warning, or $20/day for critical

Parsivex never flags on ratio alone. A tiny service that doubles from $0.50/day to $1.00/day will not trigger an alert, because the absolute increase is below the floor.

How baselines work

For each service and date, Parsivex builds a baseline from the median daily cost over the trailing 14 days before that date.

Using the median (not the average) means a prior spike does not inflate the baseline and mask a new spike. If you had one expensive day last week, it will not pull the baseline up enough to hide today's jump.

Detection requires at least 7 days of trailing history for that service. With fewer data points, Parsivex waits until enough history accumulates before flagging ratio-based anomalies.

When alerts are sent

Every day at 6:00 AM UTC, Parsivex checks yesterday's per-service costs for workspaces with anomaly alerts enabled. If any services cross the thresholds, Parsivex:

1. Records the anomalies in your workspace
2. Sends one batched email listing all spikes for that AWS connection (not one email per service)
3. Optionally posts to Slack if you configured a webhook on the Team plan

If Parsivex re-checks the same day's data, you will not receive duplicate notifications for the same anomaly.

Dashboard anomaly feed

Your dashboard shows a Cost anomalies card with the most recent spikes. Open the dedicated Cost Alerts inbox for the full history, severity filters, and acknowledged alerts.

Each row shows:

• The AWS service (or "Total AWS spend")
• The date of the spike
• Severity — amber for warning, red for critical
• A description like ~$12/day → $48/day (4× baseline)

Click Acknowledge on a row when you have reviewed the spike. Acknowledged anomalies move to the Alert history section on the Cost Alerts page but remain in your workspace record. Acknowledging does not change your AWS bill — it only marks the alert as seen.

The alerts inbox supports filtering by severity (all, critical, warning) and date range (last 7 days, last 30 days, all time). Filters apply to both active and history sections.

If your plan does not include anomaly details, rows appear with blurred amounts and an upgrade prompt. Anomaly detection still runs; full details unlock on Monthly Monitoring or Team plans.

Workspace toggle

In Integrations → Alerts, use the Daily cost anomaly alerts toggle to enable or disable anomaly detection and notifications for this workspace. The toggle is on by default on paid plans that include anomaly alerts.

When disabled, Parsivex stops checking daily costs for that workspace and does not send anomaly emails or Slack messages. Existing anomalies on your dashboard are not deleted.

Related topics

• Email and Slack monitoring alerts — alerts after monthly re-scans when new waste appears
• Setting up Slack alerts — webhook configuration for Team plan workspaces
• Your dashboard — KPI strip and alerts preview on the executive dashboard