Most AWS cost anomaly alerts are noise. Alert on the ones that matter.

The first cost alert an org sets up is almost always the wrong one: notify me when daily spend exceeds $X. It fires on the Monday after a quiet weekend, on the day a batch job runs, and on the first of the month when annual bills post. Within two weeks the channel is muted. This is alert fatigue, and it is worse than no alerting — because now nobody is watching.

The problem is not the threshold value. It is that a single number over total spend has no idea what normal looks like for each thing you run.

Baselines per service, not per bill

A useful anomaly is a service deviating from its own recent behavior. NAT Gateway data processing tripling is a signal even if it is a rounding error on the total bill; total spend rising 8% because it is month-end is not. CloudQuell builds a rolling baseline for each service and flags the ones that break from it, so the alert points at a cause — "CloudWatch is up 240% versus its 30-day norm" — not just a bigger number.

The category no threshold catches: new spend

The most expensive surprises are services you have never paid for before. A threshold tuned to your history cannot flag them, because they have no history — they arrive at some small number and grow. CloudQuell surfaces first-time spend explicitly: a dedicated card lists services that appeared this period with no prior baseline, which is where a misconfigured resource or a forgotten region usually shows up first.

From spike to scoped rule in one click

When an anomaly is real and recurring, you want an alert for exactly that shape — not another global threshold. Every anomaly row has a Bell action that opens the Alerts tab with a rule pre-filled: the service, the account, and a suggested threshold derived from the size of the jump you just saw. You are tuning a rule against a real event instead of guessing a number in the abstract.

Dismiss without deleting

Not every anomaly is worth acting on, but "acknowledge" should not mean "forget." Dismissed anomalies leave the active list and stay restorable with one click, so triage is fast and reversible. The active list stays short enough to actually read — which is the whole point.

Alerts route to Slack, Microsoft Teams, or email, so the signal lands where the team already is.