Cloudwatch Anomaly Detection

Question

My customer wishes to know more about how best to choose the "Anomaly detection threshold"  in setting up CloudWatch alarms. It is simply by trial and error?

The documentation simply states:
>   *"You set a value for the anomaly detection threshold, and CloudWatch uses this threshold with the model to determine the "normal" range of values for the metric. A higher value for the threshold produces a thicker band of "normal" values."*

For Billing alarms, the unit of the "Anomaly detection threshold" is USD currency. Can we provide some more info to customers?

Thanks!

Accepted Answer

The Anomoly Detection feature of Alarms is tied to standard deviations. For example a standard deviation of 1 would mean variations in price for that service would not alarm if the deviations fall within what is seen 68% of the time for that customer. If the deviation's magnitude is greater than what is typically seen 68% of the time then it will trigger the alarm.

A standard deviation of 2 will only trigger if the deviation is greater than what has historically been seen 98% of the time, with a standard deviation of 3 being equivalent to 99.7% of the time.

https://en.wikipedia.org/wiki/68%E2%80%9395%E2%80%9399.7_rule#:~:text=For%20an%20approximately%20normal%20data,deviations%20account%20for%20about%2099.7%25.

These values will vary by customer and service. If a customer/service has lots of variation of high magnitude then the bands will be wider (similarly if you choose a higher standard deviation value). If the customer/service has low amounts of deviation then, or a smaller standard deviation value selected, then the bands will be narrower.

Cloudwatch Anomaly Detection

Relevant content