FINANCE
Per-Customer Cost Spike Detector to PagerDuty
Watches a Datadog cost-attribution monitor and, when one customer's infrastructure spend spikes versus its 7-day baseline, opens a PagerDuty incident with the offending account…
How it runs
The automated pipeline, trigger to output.
- TriggerDatadog cost-anomaly monitor webhookDatadog
- LogicParse account + compare spike to 7-day baseline
- LogicSuppress sub-threshold noise
- ActionOpen PagerDuty incident scaled to dollar impactPagerDuty
- OutputAttach account + driver context to incidentPagerDuty
What it does
It catches runaway cost at the account level in near-real-time. When Datadog signals that a single customer's compute or data usage has jumped well above its recent baseline, this workflow pages the on-call finance-ops owner with the specific account and driver, so a misconfigured customer or abuse case doesn't run for days unnoticed.
When to use it
Use it when a single customer can spike your bill — heavy data ingestion, runaway queries, or a free-tier account abusing resources. Pairs well with the daily COGS allocator by catching anomalies between nightly runs.
How it works
- 1A Datadog monitor webhook fires when a per-customer cost metric breaches its anomaly band.
- 2The workflow parses the payload to extract the customer ID, the metric, and the spike magnitude.
- 3A logic step compares the spike against the customer's 7-day baseline and suppresses noise below a multiplier threshold.
- 4For real spikes, it opens a PagerDuty incident tagged with the account and severity scaled to the dollar impact.
- 5It posts the same context as a threaded note for the incident responder.
Set it up
What you configure once, before turning it on.
- 1Connect DatadogMetrics, traces, log search.
- 2Connect PagerDutyIncidents, on-call, escalations.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Finance workflows
Detect Annual-to-Monthly Downgrade Refunds Owed
Catches subscriptions switched from an annual term to monthly partway through the prepaid year, computes the unused prepaid balance owed back.
Detect Mid-Cycle Plan Change Mischarges and Queue Credit Memos
Listens for Stripe subscription plan changes, recomputes the correct prorated amount.
Expense Submission Webhook Instant Triage and Routing
Receives each expense submission via webhook the instant it's filed, classifies it as in-policy, needs-review, or hard-violation, and routes it to auto-approval.
Accrual Chase Board in Monday with Per-Owner Tasks
On a schedule it reads open uncoded expenses from Snowflake and creates or updates a Monday item per department owner.
Real-Time Uncoded Expense Nudge on New Spend Event
When a new expense lands without a GL code, a webhook fires and the workflow immediately Slack-nudges the spending owner to code it on the spot.
Monthly Vendor Spend Anomaly Brief for Finance Leads
Once a month, an agent analyzes the full expense ledger for vendor and category spend anomalies, drafts a narrative brief with the top outliers and likely causes.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.