call
Go to Console

 

 

 

Rule Console Guide

 

This guide covers the Rule Management section of the Bill Watch Console. It explains how to create anomaly detection rules, simulate them with historical data, and manage them through listings and batch simulation. Use this page to fully understand how rules work and how they power anomaly detection across cloud platforms

 

  • ID: A unique internal identifier automatically assigned to each rule. Used by the system for internal referencing and API calls.

 

  • User ID: Displays the full name of the Namirasoft user who created the rule. Links to the associated Namirasoft Account profile. Useful for tracking rule ownership and changes.

 

  • Workspace ID: Displays the name of the associated Namirasoft Workspace. This links to the specific workspace under which the rule is stored and applied. It ensures the rule only applies to AWS accounts assigned to that workspace.

 

  • Name: The display name for the rule. Choose a meaningful name to indicate the purpose of the rule.

 

  • Description: Optional text to describe the rule in detail including its purpose, expected outcome, or special logic used. Helps teams understand why the rule was created.

 

  • Created At: Timestamp showing when the rule was originally created.

 

  • Updated At: Timestamp showing the last time the rule was modified.

 

  • Conditions (Anomaly Formula Type): A dropdown to select the formula used to calculate expected behavior. See List of Formulas for full definitions and examples.

 

  • Change Type: Defines what kind of anomaly the rule should detect:

 

    • Increased: triggers if the value goes above the expected range.

 

    • Decreased: triggers if the value falls below expected range.

 

    • Any: triggers for either case

 

  • Threshold: The sensitivity setting for the rule. This defines the numeric threshold or multiplier needed to trigger the anomaly.

 

  • Simulator (CTA): A call-to-action button that opens the Rule Simulator. This tool lets users test rule behavior using sample or manual data before activation. It uses the same condition fields as the rule creator.

 

  • Batch Simulation (CTA): A call-to-action button that opens the Batch Simulation interface. It applies a single rule condition to multiple popular sample datasets and returns individual results for each, helping validate rule reliability across different data patterns.

 

  • Sample Date: Predefined datasets representing common usage trends. Users can load one of these to quickly see how the rule behaves.

 

  • History: Manual input field for historical cost or usage values. Users can either enter their own time-series data to simulate the rule’s behavior or use the sample data explained above.

  • Batch Simulation: Allows you to test a single rule configuration across all sample datasets.

     

  • Output Interpretation: When a rule is triggered, Namirasoft Bill Watch provides a detailed breakdown of the anomaly detection result. This helps users understand why an anomaly was triggered and which data point caused it.

 

Glossary of Output Fields: The outcome fields displayed in each result provide essential context about the watch, the analysis period, and any anomalies or errors encountered. This glossary explains each field shown in Bill Watch results so you can accurately interpret what they represent, especially when reviewing logs or alerts.

 

    • Watch ID: A unique identifier automatically assigned to each watch. It links the result to a specific monitoring configuration in Bill Watch.

 

    • Watch Name: The name assigned by the user when creating the watch. Helps in identifying the purpose or focus of the watch.

 

    • Account: The 12-digit AWS account number, or any other supported cloud account number, being monitored. This identifies the cloud account associated with the cost or usage data.

 

    • Date: The exact timestamp of when the outcome was generated. Useful for tracking activity history and troubleshooting.

 

    • Between dates: The range of time that was analyzed by Bill Watch for anomalies. Often tied to daily or multi-day runs, depending on your schedule.

 

    • ❌ Something went wrong: Indicates an error during watch execution. In this case, the AWS credential (IAM role or access key) could not be used—perhaps it was deleted or expired. More details will be available in Namirasoft Log.

 

    • ❌ Total Anomaly Found: The total number of anomaly events that were detected in the current analysis window based on active rules.

 

    • ✅ No Anomaly Found: Confirms that all monitored metrics stayed within expected thresholds.

 

    • ☑️ Watch is Deactive: Indicates the watch is currently inactive. In this state, Bill Watch is not monitoring or consuming usage time (helpful for saving on cost). No data is evaluated or alerts generated during deactivation.

 

    • Total API Called: Represents the number of API calls made to AWS or internal systems to collect and evaluate data. Higher numbers can correlate with broader analysis or multiple dimensions being scanned.

 

    • Dimension: The category used to group cost or usage metrics (e.g., by SERVICE, USAGE_TYPE, or LINKED_ACCOUNT). This helps Namirasoft Bill Watch identify trends in specific service categories.

 

    •  Metric: The specific AWS metric being monitored. In this case, UnblendedCost refers to raw costs before applying discounts or credits.

 

    • Keys: Represents the filter or key under the selected dimension. Here, “Tax” is the cost element being evaluated under the SERVICE dimension.

 

    • ❌ Anomaly has been detected: Indicates that a rule was triggered based on conditions applied to the incoming data. A structured breakdown follows (see below).

 

      • Name: The name of the anomaly formula that triggered the alert. Each formula defines a unique way to evaluate sudden changes or trends.

 

      • Data: A list of recent values (cost or usage) used as reference for evaluating anomalies. These are fetched from your cloud account’s billing records.

 

      • Data Length: Total number of reference data points used in the anomaly evaluation. It gives context to how much history the system is looking at.

      • Value: The current value being tested against the rule. If it deviates significantly based on the chosen formula, an anomaly is flagged.

 

      • Change Type: Indicates what kind of change the rule is designed to detect:

 

        • Increased: Spikes in value

 

        • Decreased: Drops in value

 

        • Any: Either direction

 

    • Formula: The logic used to calculate whether the change is anomalous. This formula checks if the absolute difference exceeds the threshold.

 

    • Value: The most recent or current value being evaluated against the rule.

 

    • Arguments: The parameter(s) set in the rule. In this case, the threshold is 2, meaning any difference of 2 or more should be flagged.

 

    • Values: Intermediate values used in the calculation:

 

      • Last: The previous value (in this case, 95)

 

      • Difference: The difference between the current value and the previous value (here, 180 – 95 = 85)

 

Example 1:

 

⏳ Date: Wed, 21 May 2025 16:30:00 GMT
🔢 Watch ID: bwt-aws-***********
🔡 Watch Name: Cost Monitor – DevOps
🆔 Account: ***********
❌ Error: Resolved credential object is not valid.
ℹ️ Please check your credential in the Credential app. See logs for more details.

 

Interpretation: The watch failed to connect due to invalid AWS credentials. This often occurs if the linked credential was deleted or permissions were changed.

 

 

Example 2:

 

⏳ Date: Fri, 06 Jun 2025 18:50:05 GMT
🔢 Watch ID: bwt-aws-***********
🔡 Watch Name: Marketing Usage Tracker
🆔 Account: ************
🕠 Period: 2025-06-01 to 2025-06-06
❌ Anomalies Found: 7
💰 API Calls Made: 10

 

Interpretation: During the selected timeframe, 7 anomalies were detected based on your rule conditions. Namirasoft Bill Watch made 10 cost-tracking API calls to gather this data.

 

 

Example 3:

 

⏳ Date: Sat, 07 Jun 2025 18:55:04 GMT
🔢 Watch ID: bwt-aws-***********
🔡 Watch Name: QA Monitor
🆔 Account: ************
🕠 Period: 2025-06-02 to 2025-06-07
✅ No Anomalies Detected
💰 API Calls Made: 10

 

Interpretation: Everything looks normal. The watch checked usage and costs, but no unexpected behavior was found within the given timeframe.

 

Example 4:

 

⏳ Date: Fri, 06 Jun 2025 19:45:00 GMT
🔢 Watch ID: bwt-aws-***********
🔡 Watch Name: Billing Healthcheck
🆔 Account: ************
☑️ Status: Watch is inactive.

 

Interpretation: This watch is currently not monitoring cost or usage. No API calls are made, and no charges apply while inactive.

 

Example 5:

 

⏳ Date: Fri, 06 Jun 2025 18:50:01 GMT
🔢 Watch ID: bwt-aws-***********
🔡 Watch Name: Finance Check
🆔 Account: ***********
🕠 Period: 2025-06-01 to 2025-06-06
💠 Dimension: SERVICE
◻️ Metric: UnblendedCost
💬 Key: Tax
❌ Anomaly Detected
─────────────────────────────
Name: AmountByLast
Value Checked: 2025-06-01 => 50.88 USD
Previous Value: 10 USD
Change Type: Increased
Formula: `Math.abs(difference) >= threshold`
Threshold: 5
Difference: 40.88

 

Interpretation: A spike in tax cost was detected, rising from 10 to 50.88 USD. Since this exceeded the defined threshold of 5, it triggered an anomaly alert. This helps you catch sudden changes before they escalate.

Want to explore other parts of Bill Watch Console?

Console Guide