Cost anomaly alerts watch your daily AWS spend per service and flag sudden spikes that may indicate a misconfiguration, runaway resource, or unexpected usage. Unlike monitoring alerts (which fire after a waste scan), anomaly alerts run every morning against yesterday's Cost Explorer data.
What gets detected
Parsivex compares each AWS service's spend on a given day to its recent normal range. Anomalies are raised per service — for example, Amazon EC2, Amazon S3, or Amazon RDS — plus a Total AWS spend row that sums across services.
A spike is flagged only when both of these are true:
- Spend jumped relative to baseline — at least 2× for a warning, or 4× for critical severity
- The dollar increase is meaningful — at least $5/day above baseline for a warning, or $20/day for critical
Parsivex never flags on ratio alone. A tiny service that doubles from $0.50/day to $1.00/day will not trigger an alert, because the absolute increase is below the floor.
| Severity | Minimum ratio | Minimum daily increase |
|---|---|---|
| Warning | 2× baseline | $5/day |
| Critical | 4× baseline | $20/day |
If a service has no cost history yet but starts billing at $10/day or more, Parsivex flags it as a warning with a "new spend" description instead of a baseline comparison.
How baselines work
For each service and date, Parsivex builds a baseline from the median daily cost over the trailing 14 days before that date.
Using the median (not the average) means a prior spike does not inflate the baseline and mask a new spike. If you had one expensive day last week, it will not pull the baseline up enough to hide today's jump.
Detection requires at least 7 days of trailing ingestion history for that connection. Days when a service had little or no spend count toward that history and contribute $0 to the baseline median, so a service that was normally idle can still be compared once enough calendar days have been ingested.
When alerts are sent
Every day at 6:00 AM UTC, Parsivex checks yesterday's per-service costs for workspaces with anomaly alerts enabled. If any services cross the thresholds, Parsivex:
- Records the anomalies in your workspace
- Sends one batched email listing all spikes for that AWS connection (not one email per service)
- Optionally posts to Slack if you configured a webhook on the Team plan
If Parsivex re-checks the same day's data, you will not receive duplicate notifications for the same anomaly.
Dashboard anomaly feed
Your dashboard shows a Cost anomalies card with the most recent spikes. Open the dedicated Cost Alerts inbox for the full history, severity filters, and acknowledged alerts.
Each row shows:
- The AWS service (or "Total AWS spend")
- The date of the spike
- Severity — amber for warning, red for critical
- A description like
~$12/day → $48/day (4× baseline)
Click Acknowledge on a row when you have reviewed the spike. Acknowledged anomalies move to the Alert history section on the Cost Alerts page but remain in your workspace record. Acknowledging does not change your AWS bill — it only marks the alert as seen.
The alerts inbox supports filtering by severity (all, critical, warning) and date range (last 7 days, last 30 days, all time). Filters apply to both active and history sections.
If your plan does not include anomaly details, rows appear with blurred amounts and an upgrade prompt. Anomaly detection still runs; full details unlock on Monitoring or Team plans.
Email preferences
Anomaly alert emails respect per-recipient notification preferences. Each workspace member and verified external alert recipient controls their own cost anomaly alert toggle independently in Settings → Alerts.
Workspace members receive a View Dashboard link in anomaly emails. External alert recipients receive the spike summary only — no login-required link, because they cannot access the Parsivex app.
When no active recipient has anomaly alerts enabled, Parsivex stops checking daily costs for that workspace and does not send anomaly emails or Slack messages. Existing anomalies on your dashboard are not deleted.
Unsubscribe links in anomaly emails turn off only that category for the person who clicked — other recipients continue receiving alerts unless they opt out separately. See Email and Slack monitoring alerts for how unsubscribe links work.
Workspace toggle
In Settings → Alerts, use the Anomalies toggle on your recipient row to enable or disable anomaly alert emails for your email address on this workspace. The toggle is on by default on paid plans that include anomaly alerts.
When you disable anomaly alerts, Parsivex stops checking daily costs for the workspace (once no other active recipient has them enabled) and does not send you anomaly emails or Slack messages. Other workspace members keep their own settings.
Cost anomaly alerts require a paid plan (Monitoring or Team). Free accounts do not receive daily cost checks or anomaly notifications. Upgrade from Billing or see Plan comparison.
Related topics
- Email and Slack monitoring alerts — alerts after monthly re-scans when new waste appears
- Setting up Slack alerts — webhook configuration for Team plan workspaces
- Your dashboard — KPI strip and alerts preview on the executive dashboard