> For the complete documentation index, see [llms.txt](https://docs.seemoredata.io/external-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.seemoredata.io/external-docs/fundamentals/our-features/monitoring-cost-management/anomalies-detection.md).

# Anomalies Detection

### What is Anomaly Detection?

Seemore's Anomaly Detection automatically identifies unusual cost patterns in your data infrastructure before they become expensive problems. Using statistical analysis and AI-powered root cause identification, the system monitors your compute costs continuously and alerts you to significant changes—whether spikes that could blow your budget or unexpected drops that might indicate issues.

{% hint style="info" %}
**Required role to configure detection rules:** [Admin](/external-docs/fundamentals/settings/user-roles.md) or higher.

Users with lower roles can view anomalies and their root-cause analysis, but cannot create, edit, or delete detection rules or change anomaly assignees.
{% endhint %}

***

### Why Anomaly Detection?

Cloud data platforms like Snowflake and Databricks make it easy to scale, but costs can quickly spiral out of control. Anomaly Detection helps you:

* **Catch cost overruns early** - Identify unusual spending patterns within 24 hours
* **Understand the why** - AI-generated root cause analysis explains what's driving each anomaly
* **Stay informed** - Automatic Slack notifications keep your team in the loop
* **Take action faster** - Prioritize high-severity issues that need immediate attention

***

### How It Works

#### Daily Monitoring

Anomaly Detection runs automatically as part of your overnight data pipeline. Every day, the system:

1. **Analyzes your spend** across all accounts and compute units (warehouses)
2. **Compares against baseline** using the previous 14 days of cost data
3. **Calculates severity** using Z-score statistical analysis
4. **Generates explanations** via AI-powered root cause analysis
5. **Sends notifications** to configured Slack channels

#### Detection Methodology

**Baseline Period:** 14 days of historical cost data

**Severity Levels:**

* **High Severity**: >4 standard deviations from baseline
* **Low Severity**: >2 standard deviations from baseline

**Classification Types:**

* **Spike** ⬆️ - Cost increased significantly
* **Drop** ⬇️ - Cost decreased significantly

#### Granularity Levels

Anomaly Detection works at multiple levels:

* **Account Level** - One anomaly maximum per account per day
* **Compute Unit Level** - Multiple anomalies per warehouse, per day
* **Job Level** - Track anomalies in specific data pipeline jobs
* **Query Level** - Drill down to individual queries

***

### Key Features

#### 🎯 Configurable Detection Rules and Notifications

{% hint style="info" %}
To enable alerts you will need to configure channels in the platform -> [Channels](/external-docs/fundamentals/settings/communication-channels.md)
{% endhint %}

Create custom anomaly detection rules and notifications tailored to your needs:

* **Default Rules** - Pre-configured to monitor top 10 most expensive warehouses per account
* **Custom Rules** - Define your own rules at account or compute unit level
* **Minimum Thresholds** - Set dollar amount minimums (e.g., only alert for anomalies >$50)
* **Asset Selection** - Choose specific accounts or compute units to monitor

Stay informed with automatic alerts:

* Real-time notifications when new anomalies are detected
* Configurable per detection rule
* Support for multiple channels and teams

#### 🤖 AI-Powered Root Cause Analysis

When you click on any anomaly, the system provides:

* **Visual Timeline** - Graph showing the baseline and the anomaly point
* **Cost Impact** - Exact dollar amount of the increase or decrease
* **Detailed Explanation** - Natural language description of what caused the anomaly
* **Contributing Factors** - Queries, jobs, and warehouses involved

***

### How To Use Anomalies detection

#### 1. Enable Default Rules

The fastest way to start detecting anomalies:

1. Navigate to **Anomaly Detection** in the Seemore app
2. Go to **Detection Rules**
3. Enable the **Default Baseline** rule
4. This automatically monitors your top 10 most expensive warehouses per account

#### 2. Configure Alerting Notifications

To receive alerts in Slack:

1. In the **Detection Rules** settings
2. Click on your active rule
3. Under **Notifications**, select **Slack**
4. Choose your channel (show to define channel)
5. Save your settings

#### 3. Create Custom Rules

For more control over what gets monitored:

1. Click **New Rule** in the Detection Rules screen
2. Choose **Account Level** or **Compute Unit Level**
3. Select specific assets to monitor
4. Set a **Minimum Threshold** (e.g., $50) to filter out small anomalies
5. Configure notification preferences
6. Activate the rule

***

### Best Practices

* **Start with defaults** - Enable the default baseline rule first to see how anomalies appear for your account before creating custom rules.
* **Set meaningful thresholds** - Use minimum dollar thresholds to avoid alert fatigue from small, insignificant cost changes.
* **Monitor high-severity first** - Focus on high-severity anomalies (>4σ) as they represent the most significant deviations.
* **Review regularly** - Check your Anomaly Dashboard weekly to identify patterns and adjust your detection rules accordingly.

***

### Need Help?

Reach out to our team if you have questions or need help configuring Anomaly Detection. We're here to help you optimize your data costs!