> For the complete documentation index, see [llms.txt](https://docs.noros.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.noros.ai/features/anomaly-detection.md).

# Anomaly Detection

Noros detects unexpected changes in your cloud costs. It analyzes cost and usage data to surface genuine anomalies while filtering out noise from normal operational patterns.

### How It Works

Noros aggregates cost data at the usage-type level and, when available, includes resource-level detail. This means for many anomalies you'll see not just that a service's costs spiked, but which specific usage type or resource contributed.

#### Types of Anomalies

Noros detects three categories of cost anomalies:

* **Cost Spikes** — Sudden, significant increases in spending identified through statistical analysis.
* **Variations & Sudden Changes** — Step-function changes where costs shift to a new baseline, indicating infrastructure or pricing changes.
* **Dips & Drop-offs** — Unexpected decreases in spending that may indicate resource deletions, lapsed reservations, or service disruptions.

Anomalies below a confidence threshold are filtered out to reduce noise.

### Asking About Anomalies

You can ask Noros about anomalies at any time:

* "Are there any cost anomalies this week?"
* "What anomalies have been detected in the past 30 days?"
* "Show me anomalies for our RDS instances"
* "What caused the spike in our compute costs on Tuesday?"
* "Are there any unusual spending patterns in us-east-1?"

Noros provides context for each anomaly, including:

* **What changed** — The specific service or usage type affected
* **When it happened** — Timing of the anomaly
* **How significant** — Dollar amount and percentage change from expected spending

### Deep Dive Investigation

When Noros surfaces an anomaly, you can ask follow-up questions to dig deeper:

* "Tell me more about that RDS anomaly"
* "Is this anomaly still ongoing?"
* "How does this compare to previous anomalies in this service?"

### Best Practices

* **Review anomalies regularly** — Ask Noros about anomalies at least weekly to stay on top of unexpected changes.
* **Investigate promptly** — The sooner you understand an anomaly, the faster you can take action if needed.
* **Correlate with events** — Ask Noros to help you connect cost anomalies to deployment events, scaling actions, or configuration changes.

### Go Further with North

Noros surfaces anomalies through conversation. With North, you get a full anomaly management dashboard — a visual timeline of all detected anomalies with masking, feedback loops, resolution tracking, and the ability to share individual anomalies to Slack, Jira, or email with full context attached. [Learn more about upgrading →](/other/powered-by-north.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.noros.ai/features/anomaly-detection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.