---
title: "Create anomaly alerts | Grafana Cloud documentation"
description: "Detect unusual patterns in your Grafana Cloud usage by comparing current consumption against a historical baseline."
---

# Create anomaly alerts

Anomaly alerts detect unusual patterns in your Grafana Cloud usage by comparing current consumption against a historical baseline, rather than firing against a fixed threshold. Use anomaly alerts to catch unexpected spikes—or unexpected drops—in Metrics, Logs, or Traces usage before they affect your bill or indicate an incident.

## Before you begin

To create or edit anomaly alerts, you must have the permissions granted by the [Usage alerts admin](/docs/grafana-cloud/cost-management-and-billing/set-up/cost-management-billing-rbac/#manage-access-to-the-cost-management-and-billing-app-using-role-based-access-control) role.

## Create an anomaly alert

To create an anomaly alert, complete the following steps:

01. Sign in to your Grafana Cloud instance.
02. Navigate to **Cost Management and Billing**.
03. Click the **Usage Alerts** tab in the top navigation menu.
04. Click **+ Create usage alerts** if no alert exists yet, or click **+ Create new alert** from the list view.
05. At the top of the drawer, select **Anomaly Detection**
06. In the **Product** drop-down, select the product you want to monitor: **Metrics**, **Logs**, or **Traces**.
07. Review the visualization to preview how the anomaly bounds look against your recent usage history.
08. In the **Sensitivity** field, select a detection level:
    
    - **Low**—Fires only on large deviations. Produces fewer alerts.
    - **Medium**—Balanced detection. Recommended for most use cases.
    - **High**—Fires on smaller deviations. May produce more alerts.
09. Toggle **Detect drops** off if you don’t want to be alerted when usage falls. Keeping it on is good for detecting certain types of incidents.
10. From the **Contact point** drop-down, select where alert notifications should be sent. If you haven’t set up a contact point, click **View or create contact points** to configure one.
11. Click **Create alert** to save your new anomaly alert.

The alert becomes active immediately and begins evaluating your usage against the anomaly bounds. There may be some delay in updating the status, but it should be visible within a minute.

## Edit an anomaly alert

To edit an existing anomaly alert, complete the following steps:

1. Sign in to your Grafana Cloud instance.
2. Navigate to **Cost Management and Billing**.
3. Click the **Usage Alerts** tab in the top navigation menu.
4. Click the anomaly alert you want to edit.
5. Update any of the following settings:
   
   - **Sensitivity**—Adjust how sensitive the alert is to deviations from the baseline.
   - **Detect drops**—Enable or disable alerting on usage drops below the lower bound.
   - **Contact point**—Change where notifications are sent.
   - **Status**—Pause or re-enable the alert using the status toggle.
6. To discard all unsaved changes, click the **Cancel** button
7. Click **Save** to apply your changes.

> Note
> 
> The monitored product cannot be changed after an anomaly alert is created. To monitor a different product, create a new anomaly alert.

## How anomaly detection works

Anomaly alerts use a statistical model to establish expected usage bounds. Each evaluation compares a rolling average of current usage against bounds derived from usage at the same time one week ago.

### Sensitivity levels

The sensitivity level controls how tightly the bounds are drawn around the historical baseline:

Expand table

| Sensitivity | Averaging window | Standard deviations | Minimum band width |
|-------------|------------------|---------------------|--------------------|
| High        | 6 hours          | 2                   | 2%                 |
| Medium      | 12 hours         | 2.5                 | 5%                 |
| Low         | 24 hours         | 3.5                 | 10%                |

All sensitivity levels use the same 7-day reference range: the baseline is always drawn from usage at the same time one week ago.

- A **shorter averaging window** makes the alert more responsive to rapid changes.
- **Fewer standard deviations** draws tighter bounds, catching smaller deviations.
- A **smaller minimum band width** allows the bounds to narrow during stable periods.

### Drop detection

When **Detect drops** is enabled, the alert also fires when usage falls below the lower bound. Unexpected drops can indicate misconfiguration or a silent incident—for example, telemetry that stops arriving without generating any errors.

### Alert naming

Anomaly alerts are automatically named using the format **Anomaly: \[Product] (\[Sensitivity])**, for example, `Anomaly: Metrics (Medium)`.