{
  "id": "workflow:cost-anomaly-alerting-setup",
  "_kind": "Workflow",
  "_file": "workflows/workflows/workflows-finops-setup.yaml",
  "_cluster": "workflows",
  "attributes": {
    "displayName": "Cost Anomaly Alerting Setup",
    "workflowKind": "operational",
    "triggerType": "on-demand",
    "typicalCadence": "per-milestone",
    "complexity": "cross-team",
    "description": "Designs and implements the cost anomaly detection and alerting\ninfrastructure -- defining anomaly detection thresholds using statistical\nbaselines (standard deviation bands, percentage-over-forecast) calibrated\nper service and team to minimize false positives, configuring multi-tier\nalert routing with severity levels mapped to cost impact magnitude\n(informational, warning, critical), establishing escalation rules that\nauto-notify team leads for moderate anomalies and trigger incident response\nfor critical spend spikes, integrating anomaly alerts with communication\nchannels (Slack, PagerDuty, email) with appropriate context including\naffected resources, estimated daily run-rate, and suggested investigation\nsteps, creating anomaly investigation runbooks with common root-cause\npatterns, setting up weekly anomaly review meetings to tune thresholds and\nclose resolved alerts, and building an anomaly historical log for pattern\nrecognition. Produces alerting architecture document, threshold\nconfiguration, escalation matrix, and investigation runbooks. Excludes\nanomaly remediation.\n"
  },
  "outgoingEdges": [
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "role:cloud-architect",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "role:platform-engineer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "role:engineering-manager",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "skill-area:observability-pipeline",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "skill-area:sli-slo-management",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "domain:finops",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "domain:operations",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "responsibility:respond-incidents",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "responsibility:runbook-authoring",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "org-unit:finops-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    },
    {
      "from": "workflow:cost-anomaly-alerting-setup",
      "to": "org-unit:platform-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}