Monitors

Monitors let you set up cost anomaly detection across your cloud and AI spend, scoped to the accounts, services, users, or other cost categories you care about. When a Monitor detects a significant, unexpected change in spend, CloudZero opens an Alert so your team knows exactly what happened and can investigate.

In CloudZero, select Monitors from the left navigation.

How Monitors work

A Monitor watches a specific slice of your spend. CloudZero forecasts that spend every day, learns its normal range from your recent history, and flags a day as an anomaly when spend rises well above that range. An optional threshold on the Monitor then filters which detected anomalies become Alerts. CloudZero lists Alerts on the Alerts tab, and you create and manage Monitors on the Monitors tab.

What the Alerts tab shows

The Alerts tab gives you a complete picture of Alerts across your environment, covering every Alert with anomalous spend in the selected date range (Last 90 days by default). To change the range, open the date picker and choose a preset under Quick Ranges or select custom dates, up to 365 days back.

Three summary cards sit above the list of Alerts:

• Total Cost Impact: The full cost impact of every Alert with an anomalous day in the selected date range, including spend outside the range, with the change from the previous period of the same length
• Last 7 days: The full cost impact of every Alert with an anomalous day in the last 7 days, with the change from the previous 7 days, regardless of the selected date range
• Total Alerts: The number of Alerts with an anomalous day in the selected date range, with a bar showing how many are in each status (Needs review, Investigating, and Resolved) and a chip for each status that filters the Alerts below

Below the summary, the Alerts table lists these Alerts with their status, title, a Trend sparkline of cost over the Alert's duration, Cost Impact, the Spend state (Spend Elevated while the anomaly continues, Spend Normal once it stops), the Monitor that raised them, when they started (Started On), and when they were last updated (Last Updated). The table lists Alerts with the highest cost impact first. The Work Item column, which shows the ticket linked to each Alert, is hidden by default; turn it on from the table's column settings. Select Load more to show more Alerts, or Export to download the Alerts in the table as a CSV file.

Find an Alert

Use the controls above the table to narrow the list:

Each filter accepts more than one value. Within one filter, an Alert can match any of the values you select. When you set more than one filter, an Alert must match all of them.

View Alert details

Select an Alert to open the detail flyout. The flyout gives you the full context of the Alert and lets you investigate and take action.

Overview tab

The Overview tab shows the complete picture of the Alert:

• Summary: An AI-generated description of the anomalous spend
• Cost Impact: The difference between expected and actual spend, shown at the top of the flyout
• Cost Chart: A chart showing spend around the time of the Alert, with a View in Explorer option that opens Explorer with the Alert's filters already applied
• Details: The Monitor that raised the Alert (select it to open the Monitor's details), when the Alert started (Started On), when it was last updated (Last Updated), its Spend state, and its Duration
• Contributing Resources: A table of all resources involved in the Alert, showing each resource's name, service, account, region, and provider (select a resource to view it in Explorer)

Activity tab

The Activity tab shows a timeline of the Alert's lifecycle: when it was created, each time its status changed (including the Resolution Reason when it was resolved), each time its Spend state changed, when a Work Item was linked or unlinked, and whether CloudZero resolved it automatically. Each entry has a timestamp. When a person changes the status, the entry also shows who made the change.

Add a comment from the Activity tab to capture context for your team, such as what you found during an investigation or why you resolved the Alert. Comments appear inline with the rest of the timeline, in the order they were posted, with the author and timestamp. You can edit or delete your own comments; you cannot edit or delete comments from other people. Commenting is allowed on resolved Alerts and does not change the Alert's status.

Manage an Alert

If you have Monitors write permission, you can change an Alert's status from the Status control in the flyout footer or directly from the Status column in the results table.

Alert statuses

• Needs review: The Alert is new and no one has reviewed it yet.
• Investigating: Your team is reviewing the Alert.
• Resolved: The Alert is closed, either by your team or automatically by CloudZero.

Resolve an Alert

To resolve an Alert yourself, change its status to Resolved and select a Resolution Reason:

• Intentional: The spend change was expected, such as a load test or a planned migration.
• Remediated: Your team fixed the underlying cause, such as by terminating idle instances.
• Self-Resolved: The spend stopped on its own, such as when a one-off job finished.
• Not an Anomaly: The spend change is a regular pattern, such as a monthly billing spike.

You can add optional details, up to 255 characters, to explain the resolution. If the Alert's spend is still elevated, CloudZero shows a Spend is still elevated warning before you resolve it.

After 2 days with no anomalous spend, an Alert's Spend state changes to Spend Normal. If the Alert's status is still Needs review 7 days later (9 days after its last day of anomalous spend), CloudZero resolves it automatically. CloudZero never automatically resolves an Alert in Investigating status.

Track an Alert in Jira

If you connect the Jira integration, you can create a linked Jira Work Item directly from an Alert's details flyout instead of recreating the context by hand. Select Create Work Item in the flyout footer. CloudZero pre-fills the title with the Alert's title and the description with its cost impact and AI-generated summary. When the Alert has Dimensions or tags, CloudZero also lists them in a CloudZero context section at the end of the description and fills any Jira fields your organization has mapped to that data. You can edit all of it before creating the Work Item. Creating a Work Item requires Monitors write permission.

Once linked, the flyout footer shows the Work Item's key, status, and a link to open it in Jira. The Alert and the Work Item stay in sync in both directions. When the Alert's status changes in CloudZero, including when CloudZero resolves it automatically, the Work Item moves to the matching Jira status:

When the Work Item's status changes in Jira, CloudZero updates the Alert:

Your Jira integration's status mapping controls which of your Jira statuses count as not started, in progress, resolved, or ignored, so the exact Jira status a Work Item moves to depends on how you've mapped your Jira workflow. To change the mapping, go to Settings > App Integrations, select Settings on the Jira integration, and update the Status Mapping section.

The most recent change on either side wins, and the Activity tab records which changes came from Jira.

To remove the link, select Unlink next to the Work Item. The Work Item itself is not deleted or changed in Jira, and you can create a new one for the Alert afterward.

What the Monitors tab shows

Select the Monitors tab to see and manage your Monitors. The results table shows each Monitor's name, its Status (Active if it's running, Paused if it isn't), who created it (Created By, which shows CloudZero for System Monitors), how many Active Alerts it has (Alerts in Needs review or Investigating status), and when it last triggered (Last Triggered). Select a Monitor's Active Alerts count to open the Alerts tab filtered to those Alerts. Use the All, Active, and Paused quick filters above the table to narrow the list. Select New Monitor to create a new Monitor.

Select a Monitor to open its details flyout. The Overview tab shows the Monitor's settings and lists up to 10 of its active Alerts, highest cost impact first. When the Monitor has more than 10, a link opens all of them on the Alerts tab.

Create a Monitor

1. Select New Monitor. The Create Monitor drawer opens, with its settings grouped into collapsible sections.

2. In Details, name the Monitor and, optionally, add a description.

3. In Cost Type, choose a Cost Type: Amortized Cost, Billed Cost, Custom Cost, Discounted Cost, Discounted Amortized Cost, Invoiced Amortized Cost, On-Demand Cost, or Real Cost (the default). A Monitor watches one Cost Type; create a separate Monitor to track a different one. For definitions, see Cost Types.

4. (Optional) In Filters, add filters to scope the Monitor to the spend you care about.

5. (Optional) Select Add Group By and choose a Dimension, such as account, service, or user. CloudZero then evaluates each element of that Dimension separately (for example, each service), with your threshold applied to each element. A Monitor evaluates up to 5,000 elements, those with the highest spend over the last 30 days.

6. Review the cost preview to confirm the Monitor matches the spend you expect before saving.

7. (Optional) In Anomaly Detection, turn on Custom threshold and set a threshold to filter which detected anomalies become Alerts:

   • Percentage above normal range: How far above the top of CloudZero's normal range the day's spend must be, as a percentage of the top of that range
   • Minimum cost impact: How far above the top of CloudZero's normal range the day's spend must be, as a currency amount

   If you set both, the day's spend must clear both before CloudZero opens an Alert. For example, if the top of CloudZero's normal range for a day is $1,000 and you set Percentage above normal range to 20% and Minimum cost impact to $500, CloudZero opens an Alert only when that day's spend rises above $1,500. If you leave Custom threshold off, every anomaly CloudZero's forecasting model identifies becomes an Alert.

8. (Optional) If notifications are enabled for your organization, choose where CloudZero sends notifications when the Monitor opens an Alert. You can use either option or both:

9. Select Save Monitor.

After you save a Monitor, CloudZero evaluates its scope as soon as the next cost data ingest completes, then once a day after that.

Edit, pause, or delete a Monitor

To edit a Monitor: Select Edit from the Monitor's row, update any of its settings, and select Save Monitor.

To pause or resume a Monitor: A paused Monitor is not evaluated and opens no new Alerts. Select Pause or Resume from the Monitor's row, or from its details flyout.

To delete a Monitor: Select Delete from the Monitor's row and confirm. Deleting a Monitor also deletes its Alerts.

View Monitor activity

Every change to a Monitor is on the record, so you can answer questions like "who turned off this Monitor's notifications" without asking around. Select a Monitor to open its details flyout, with Overview and Activity tabs. The Activity tab lists every change made to the Monitor itself: when it was created, each edit (including threshold changes), every time it was paused or resumed, and every notification channel added or removed, along with who made the change and when.

This is separate from an Alert's own Activity tab, which tracks the Alert's lifecycle rather than the Monitor's configuration. See View Alert details.

System Monitors

CloudZero runs three System Monitors for you. They're already watching your spend when you turn on Monitors, so you see Alerts without building anything:

System Monitors track Real Cost across all of your spend, with no filters, so every anomaly they detect becomes an Alert unless you set a threshold. When the Account Monitor and the Service Monitor both detect the same spike, CloudZero shows the Service Monitor's Alert, since it pinpoints which service changed, and hides the duplicate account-level Alert.

If you have Monitors write permission, you can adjust a System Monitor's threshold. Select Edit from the Monitor's row, turn on Custom threshold in Anomaly Detection, then change the Percentage above normal range, the Minimum cost impact, or both. For example, raise the Service Monitor's Minimum cost impact to $500 so only larger service-level changes open an Alert. If notifications are enabled for your organization, the same panel also lets you add email addresses or a Slack Channel ID. Select Save Monitor to save your changes. A System Monitor's name, what it measures, and its filters and grouping stay fixed, and System Monitors can't be paused, resumed, or deleted.

Putting it together: from Alert to resolution

Set up a Monitor once, and CloudZero takes it from there. Every day, CloudZero checks the spend you scoped against what it expects to see and opens an Alert when actual costs deviate from expected trends.

From the Alerts tab, open the flyout to see the AI-generated summary, the cost chart, and the resources driving the change. Move the Alert to Investigating while your team looks into it, then resolve it with the Resolution Reason that fits: Intentional, Remediated, Self-Resolved, or Not an Anomaly.