> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Cost Anomalies > Review unusual daily cost changes, record what they mean, and ask Anna to investigate with provider evidence Anomalies shows finalized daily cost changes that exceed their expected range for one Optimize connection. Detection uses saved billing data; Anna investigates the provider evidence behind a detected change. ## Read the summary The summary covers the selected 30-day or 90-day range and keeps detection coverage visible. If Optimize is still building a baseline, it shows how many finalized days are available instead of claiming no anomalies exist. Anomaly cost is delayed billing evidence, not real-time monitoring data. **Estimated impact** is actual cost above the baseline. It is not a savings estimate or invoice adjustment. ## Review the queue Use the tabs to move between review states: | State | Meaning | | ------------- | ------------------------------------------------------------------------------------- | | Needs review | Nobody has recorded what the change meant | | Investigating | An Anna investigation has started | | Reviewed | A human recorded what the change meant (a disposition) | | Retracted | The supporting data changed and the agent withdrew the anomaly with a recorded reason | Filter the queue by severity or disposition. Choose **30 days** or **90 days** to change the evidence window. ## Inspect the evidence Open an anomaly to see its date range, actual cost, baseline, expected upper bound, estimated impact, deviation, severity, top regions, billing cutoff, and daily series. One card can cover a multi-day episode. The daily Optimize scan extends the same card while the increase continues and retracts a record its data no longer supports. Estimated impact and severity always come from saved billing data, never from an agent's judgment. An **Explained by** list appears when an agent has linked findings as the likely cause of the spike. Select one to open the full finding record without leaving the anomaly. ## Record what the change meant After review, choose one disposition: | Disposition | Meaning | | ----------------- | ---------------------------------------------------------------- | | Unexpected change | The increase needs follow-up or corrective action | | Expected change | The increase matches an intentional business or technical change | | Insignificant | The evidence is valid but does not justify more work | You can reopen a reviewed anomaly. Reopening returns it to **Needs review** without deleting its history. ## Investigate with Anna Select **Investigate with Anna** from the anomaly detail. Each click opens a fresh conversation with the current anomaly evidence and the exact cloud connection in scope. Anna can inspect live provider cost breakdowns and change history, but she does not invent a cause. If credentials, provider access, or available evidence cannot establish the cause, the investigation says so. Later investigations can reuse saved findings from earlier conversations about the same anomaly. ## Refresh failures Optimize keeps the last successful billing evidence readable when a refresh fails. A paused refresh applies only to the selected connection and does not mark the cloud connection disconnected. Fix the reason shown in Optimize, then run a manual retry. A successful retry clears the pause and requests fresh evidence. ## Related Return to the account decision snapshot Review an action that explains or responds to a cost change Compare the change with completed monthly service spend Generate an anomaly review log