# Anomaly Detection

Noros detects unexpected changes in your cloud costs. It analyzes cost and usage data to surface genuine anomalies while filtering out noise from normal operational patterns.

### How It Works

Noros aggregates cost data at the usage-type level and, when available, includes resource-level detail. This means for many anomalies you'll see not just that a service's costs spiked, but which specific usage type or resource contributed.

#### Types of Anomalies

Noros detects three categories of cost anomalies:

* **Cost Spikes** — Sudden, significant increases in spending identified through statistical analysis.
* **Variations & Sudden Changes** — Step-function changes where costs shift to a new baseline, indicating infrastructure or pricing changes.
* **Dips & Drop-offs** — Unexpected decreases in spending that may indicate resource deletions, lapsed reservations, or service disruptions.

Anomalies below a confidence threshold are filtered out to reduce noise.

### Asking About Anomalies

You can ask Noros about anomalies at any time:

* "Are there any cost anomalies this week?"
* "What anomalies have been detected in the past 30 days?"
* "Show me anomalies for our RDS instances"
* "What caused the spike in our compute costs on Tuesday?"
* "Are there any unusual spending patterns in us-east-1?"

Noros provides context for each anomaly, including:

* **What changed** — The specific service or usage type affected
* **When it happened** — Timing of the anomaly
* **How significant** — Dollar amount and percentage change from expected spending

### Deep Dive Investigation

When Noros surfaces an anomaly, you can ask follow-up questions to dig deeper:

* "Tell me more about that RDS anomaly"
* "Is this anomaly still ongoing?"
* "How does this compare to previous anomalies in this service?"

### Best Practices

* **Review anomalies regularly** — Ask Noros about anomalies at least weekly to stay on top of unexpected changes.
* **Investigate promptly** — The sooner you understand an anomaly, the faster you can take action if needed.
* **Correlate with events** — Ask Noros to help you connect cost anomalies to deployment events, scaling actions, or configuration changes.

### Go Further with North

Noros surfaces anomalies through conversation. With North, you get a full anomaly management dashboard — a visual timeline of all detected anomalies with masking, feedback loops, resolution tracking, and the ability to share individual anomalies to Slack, Jira, or email with full context attached. [Learn more about upgrading →](/other/powered-by-north.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.noros.ai/features/anomaly-detection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.