Cost incidents

A spend alert records the query, time window, match count and status of an unusual pattern. A cost anomaly records the account code, detection time and estimated excess cost. When the analyst needs a coordinated investigation, an incident gives the signal a priority, assignee, service and state. The Business Overview page helps the team see the active distribution alongside recent evidence.

An incident begins Open. The assigned analyst acknowledges it, investigates the service and cost lines, then records the resolution and closure. Cost event log records key events such as acknowledgment and mitigation. Incident updates captures dated, attributed notes. These records make the investigation understandable after the alert itself has closed.

• Signal. Inspect alert windows and anomaly estimates before setting incident priority.
• Assignment. Name the person responsible and the service affected by the charge.
• History. Record events and updates as the cause and response become clear.

Decide which spend signal warrants an incident and what the priority labels mean for cost exposure. Map each active service to an owner and identify the analyst who covers it. A cost watch shifts schedule can show who is on watch and the escalation level for the service. Agree when an anomaly is cleared and who checks that the incident outcome explains the unusual amount.

Rehearse with one recent charge whose explanation is already known. The team should be able to follow the line, signal, incident, update and final outcome without relying on memory.

A daily charge rises for an account that usually has stable usage. The analyst checks the anomaly reference and estimated excess cost, opens a High priority incident, and assigns it to the service analyst. The analyst acknowledges the incident and adds an update explaining which cost lines were checked. The service owner confirms whether a deployment increased usage. If the increase is unintended, the owner records a recommendation and prepares a change. After the action, the analyst records the cost event and marks the incident Resolved. The owner checks the explanation before closing it.

The same record should distinguish an investigation from a confirmed saving. A resolved incident explains what happened; savings need a later verification against the expected amount.

• Open Incidents — Follow acknowledged and investigating cost cases by assignee.
• High Priority Incidents — Find urgent cases that need the next owner response.
• Uncleared Cost Anomaly Events — Review signals still awaiting a clear date.

Read incident investigation and change to verification.