# Alerts & anomaly detection

Finora has two complementary systems that watch your spend for you:

* **Budget rules** — you set a threshold, Finora notifies you when it's approached or crossed.
* **Anomaly detection** — Finora automatically watches for unusual spikes, no setup needed.

Both deliver to email, and on the Scale plan and above, to Slack.

***

## Budget rules

Open **Alerts** in the sidebar to manage your budget rules.

### Creating a budget rule

1. Click **+ New budget rule**.
2. Configure:
   * **Name** — something descriptive, e.g. *OpenAI monthly cap*
   * **Scope** — all providers, a specific provider, or a tag-scoped slice (e.g. `team:vision`)
   * **Threshold** — e.g. **$1,000**
   * **Period** — daily, weekly, or monthly
   * **Notify at** — 80%, 100%, or both (default: both)
   * **Channel** — email, Slack (Scale+), or both
3. Save.

### When the rule fires

Finora checks every rule once a day. If your spend for the period reaches **80%** of the threshold, you get an alert. If it crosses **100%**, you get another.

Each rule is checked only against the spend of the person who created it.

### Triggered alerts

Open **Alerts → Triggered** to see a history of every alert that fired:

* When it fired, the rule, the threshold, and the actual spend
* Which channels were notified
* Status: **Open** (still above threshold) or **Resolved** (back below)

### Snoozing & disabling

* **Snooze** a rule for 7 days from the row menu — useful during a known one-time burst, like a product launch.
* **Disable** a rule to stop checking it without deleting it.
* **Delete** removes the rule and all its history.

### How many budget rules can I have?

| Plan       | Max budget rules |
| ---------- | ---------------- |
| Trial      | 2                |
| Growth     | 5                |
| Scale      | 20               |
| Enterprise | unlimited        |

***

## Anomaly detection

Finora watches every connected provider for unusual cost spikes — without you configuring anything. Open the **Anomalies widget** on the [Overview](/core-features/overview-dashboard.md) to see what's currently flagged.

### How it works

Finora compares each day's spend against the average of the previous 7 days for that same provider. If a day is meaningfully higher than expected, it's flagged.

To avoid noisy false positives, both of these need to be true:

* The day is **at least 50% above** the 7-day average
* The spike is **at least $50** in absolute terms

Lower-value spikes don't trigger anomalies — Finora is calibrated to surface the things that actually matter.

### Severity levels

| Level      | When                                                         |
| ---------- | ------------------------------------------------------------ |
| **Low**    | The day is more than 50% above average and at least $50 over |
| **Medium** | More than 2× average, or at least $200 over                  |
| **High**   | More than 3× average **and** at least $500 over              |

### Notifications

Only **High severity** anomalies on the current day trigger an email or Slack notification. Lower severities are visible in the Anomalies widget for review but won't ping you.

This filtering is intentional — it keeps the noise floor low so when you do get an anomaly notification, it's worth looking at.

### Why your spike might not be flagged

Common reasons:

* **The spike was below $50.** The minimum dollar threshold avoids tripping on small daily fluctuations.
* **The 7-day average was already high.** If the previous days were also elevated, today doesn't read as anomalous.
* **The provider has less than 7 days of history.** Finora needs a baseline to compare against.

***

## Setting up notifications

To enable Slack delivery and configure your default email, see [Email & Slack notifications](/notifications/email-and-slack.md).

## When to use which

The two systems answer different questions:

* **Budget rule** — *"Am I going to blow my plan for the month?"*
* **Anomaly** — *"Did something change today that I didn't expect?"*

Most teams want both: a monthly cap per provider as a budget rule, plus the built-in anomaly detector for sudden spikes.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.finora.services/core-features/alerts-and-anomalies.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.