DATA OPS
Webhook-Triggered BigQuery Cost Spike Investigator Agent
When a cost-monitor webhook fires, an agent investigates the BigQuery spend spike — pinpointing the owner, project, and queries responsible.
How it runs
The automated pipeline, trigger to output.
- TriggerCost-spike webhook receivedHTTP webhook
- ActionQuery BigQuery job history for the spike windowBigQuery
- LogicAttribute spike to owner/project/query, classify new vs recurring
- ActionRun follow-up BigQuery queries to disambiguate if neededBigQuery
- OutputPost root-cause writeup to Microsoft TeamsMicrosoft Teams
What it does
It responds to a spend-anomaly webhook (from a budget alert or monitoring tool) by running an agentic investigation. The agent queries `INFORMATION_SCHEMA.JOBS` across the spike window, isolates which owner, project, and specific queries account for the jump, checks whether it's a new pattern or a scaled-up recurring job, and writes a root-cause summary with a recommended action.
When to use it
Use it when you already have spike detection but want the on-call to receive a diagnosis instead of just an alert. The agent does the first 20 minutes of triage automatically, so responders open the Teams message already knowing who and what to look at.
How it works
- 1An incoming webhook carries the spike window and magnitude.
- 2The agent queries BigQuery job history for that window, grouping spend by owner, project, and query.
- 3It reasons over the results to attribute the spike and classify it as new versus a scaled recurring job.
- 4If attribution is ambiguous, it runs follow-up BigQuery queries to narrow it down.
- 5It posts a diagnosed root-cause writeup with recommended next steps to a Microsoft Teams channel.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect BigQueryDatasets, queries, schemas.
- 3Connect Microsoft TeamsChannels, chats, files.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Data Ops workflows
Weekly BigQuery Cost Trend Sheet and Exec Digest
Compiles week-over-week BigQuery scheduled-query cost by owner and dataset into a Google Sheet with trend columns.
Daily BigQuery Scheduled-Query Cost Attribution to Owners
Each morning, totals the prior day's on-demand bytes-billed per scheduled query, maps each query to its owner from a label, and posts a per-owner cost leaderboard to Slack.
BigQuery Per-Team Budget Breach Alert to PagerDuty
Tracks month-to-date BigQuery scheduled-query spend per team and, when a team crosses its monthly budget, pages the team's on-call in PagerDuty and snapshots the spend breakdown…
dbt source freshness watcher with severity-routed alerts
Checks Snowflake loaded-at timestamps against each dbt source's freshness SLA, then routes warnings to Slack and hard breaches to a PagerDuty incident so stale data never…
dbt orphan model detector with Linear cleanup tickets
Scans your dbt manifest for models that no other model, exposure, or BI tool consumes.
Raw Sensor Telemetry Archive to BigQuery
Captures every incoming building sensor reading via webhook, normalizes the payload into a consistent schema.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.