Anomalies Explorer

Investigate every cost anomaly StratoLens has detected. Drill from a subscription down to a single resource and see exactly what changed. Open Costs > Cost Anomalies from the left sidebar.

Filters and Controls

The header above the columns shows N anomalies detected from M resources, reflecting the current filter state. Every filter applies client-side, so adjustments are instant, no spinner or refetch.

Time Period: Display window: 7 days, 30 days, 60 days, or 90 days. Filters which detected anomalies are shown. The scanner always analyzes 90 days regardless of this setting.
% Threshold: Minimum percent change required for an anomaly to appear. Range 0 to 1000. Invalid input shows a warning icon and resets on blur.
$ Minimum: Minimum absolute change required for an anomaly to appear. Range 0 or greater.
Direction: All, Increase, or Decrease. Drives both the list filtering and the colored badges (red for increases, green for decreases) on tree rows.
Sort by: Severity, Date, Date & Location, Cost Impact, or Alphabetical.
Tree View: Checkbox. When checked, shows the 3-column subscription → resource group → resource hierarchy. When unchecked, shows a flat list.
Hide one-time charges: Checkbox. Filters reservation purchases, refunds, and Azure Marketplace charges out of the list. The count of charges currently being hidden appears next to the label.
Show hidden: Only appears when at least one resource is hidden. When checked, hidden resources reappear with muted text styling so you can review or unhide them.

Compact mode

When the window is narrow, Sort, Direction, and threshold inputs collapse into a Filters popover. A number badge on the button shows how many filters are at non-default values.

Tree View

Three columns appear in sequence: Subscriptions, Resource Groups, and Resources. Selecting an item in one column populates the next.

Subscriptions: Lists every subscription with at least one anomaly. Each row shows the subscription name and red/green direction badges with anomaly counts.
Resource Groups: Appears once a subscription is selected. Lists resource groups within that subscription that have anomalies.
Resources: Appears once a resource group is selected. Each row shows the resource type icon, name, direction badges, and the most recent change in dollars.
Detail panel: A fourth column on the right shows full anomaly detail for the selected resource. See Resource Detail Panel.

List View

Uncheck Tree View to switch to a flat list. The header reads Resources with Anomalies (N), and each row shows:

The resource type icon and name
The resource group it belongs to
A severity dot: 🔴 High, 🟠 Medium, or 🟡 Low
A total anomaly count badge if the resource has more than one anomaly
The total cost impact across all anomalies for that resource

Selecting a row opens the same detail panel described below in the right pane.

Resource Detail Panel

Selecting a resource opens a detail panel with everything you need to investigate a single resource's cost behavior.

Cost Impact Summary

At the top, four large stat boxes show the headline numbers:

Cost Change: Signed dollar amount with a red up arrow (increase) or green down arrow (decrease).
Baseline Cost: The resource's normal cost level before the anomaly.
Change: Percent change relative to the baseline.
New Cost: The new cost level after the anomaly.

Cost Trends Tab

A line chart of the resource's cost over time, with anomaly markers on the dates where StratoLens detected a change. The Y-axis uses the subscription's billing currency. The X-axis matches the page-level Time Period.

All Anomalies Tab

One card per anomaly. Each card carries one of two labels:

Cost Spike (🔴) when cost went up. Description reads "Cost Spike: X% increase ($Y) on DATE".
Cost Drop (🟢) when cost went down. Description reads "Cost Drop: X% savings ($Y) on DATE".

Each card also shows the date, signed change in dollars and percent, baseline cost, and new cost.

Click a card to focus history

Clicking an anomaly card filters the Resource History section below to a 3-day window around that anomaly, so you can quickly see what configuration changes happened around the same time.

Resource History

Always visible at the bottom of the panel. Lists configuration changes and activity for the resource so you can correlate cost shifts with what changed. For example, if a VM was resized on the same day costs jumped, both events appear here side by side.

Header Actions

Hide (or Unhide if the resource is already hidden) suppresses the resource from views and notifications. See Hiding Resources.
View in Explorer opens the resource in the main StratoLens Explorer for full configuration detail.

Hiding Resources

Use Hide to suppress a known-noisy resource from the page without disabling detection. To hide a resource:

Select the resource so its detail panel is open.
Click Hide in the panel header.
Optionally provide a reason in the dialog.
Confirm. The resource disappears from the list immediately.

Hiding a resource removes it from:

This page
The Cost Anomalies dashboard widget
Notification emails
Scheduled reports

Detection still runs on hidden resources

Hide only suppresses a resource from views and notifications. The scanner still analyzes it on every scan, so when you unhide, the full anomaly history is there. Both Hide and Unhide actions are written to the Activity Log along with the optional reason.

To show hidden resources, check Show hidden at the top of the page (the checkbox only appears once at least one resource is hidden). Hidden resources display with muted text styling. Open a hidden resource's detail panel and click Unhide to restore it.

Behavior

Page-level thresholds can only narrow, not widen

The % Threshold and $ Minimum inputs on this page filter anomalies that the scanner already detected. If the scanner threshold is higher than what you type here, the page filter has nothing extra to surface, you must lower the scanner threshold and wait for the next scan. See Settings.

The 90-day analysis window is fixed

The Time Period dropdown narrows what is displayed, not what was analyzed. The scanner always looks at the last 90 days when identifying a resource's normal cost pattern.

Timing of email notifications

Hidden state is read at the moment an email is generated. If a notification was queued before you hid a resource, that email may still include it. Future emails will exclude hidden resources.

Troubleshooting

I don't see any anomalies

Things to check

Thresholds may be too high for your environment. Try lowering % Threshold to 5 and $ Minimum to 0.
Time Period may be too short. Widen it to 90 days.
The most recent scan may not have completed yet, so detection has not run on fresh data.
If Hide one-time charges is on and the only anomalies are reservation purchases or Marketplace charges, uncheck it to see them.

I lowered the threshold but the list didn't change

Page thresholds are a filter, not the floor

The page threshold filters anomalies the scanner has already detected. If the scanner threshold is higher than what you typed, lowering the page threshold surfaces nothing extra. Lower the scanner threshold under Settings > Scanner and wait for the next scan.

A resource I hid is still showing up in an email

Already-queued emails include the hidden resource

Hidden state is read at the time an email is generated. If the email was queued or sent before you hid the resource, it still includes the resource. Future emails will exclude it.

The amounts are in EUR, but I expected USD

Currency follows the subscription

Costs display in the Azure billing currency for each subscription. If a subscription is billed in EUR, anomalies for resources in that subscription appear in EUR.

Anomalies disappeared after a scan

Anomalies recompute every scan

If a resource's cost stabilized within the last 90 days, its anomalies legitimately drop off the list. Check the Activity Log if you need a historical record.

Documentation coming soon

The exact severity cutoffs (the change size at which a Low becomes a Medium and a Medium becomes a High) are subject to product confirmation and not yet published as a committed contract. Read severity as a relative rank within your environment.