Investigate a cost spike and find the deploy behind it
When spend moves, the agent finds the deploy, team and service behind it, checks incidents and provider events from the same window, and posts the likely cause.
Runs in
Claude · Slack
First optimization recommendation
The next day
ROI
Pays for itself with the first recommendation you act on
Investigate a cost spike and find the deploy behind it
Question
Why did our AWS bill go up last week? Break it down by team and service, and list any deploys or provider events in the same window.
Query
Result
Finding
AWS spend was up 12% week over week. Data Platform +€2,140 on Amazon EMR after deploy spark-jobs v2.3 (Tue 14:02). Checkout +€860 on RDS after an instance class change. ML +€410 on Bedrock after the 'summaries' flag.
You decide
The owner confirms the cause and decides on a fix.
Playbook
What the agent does
From what Costory notices to what you decide. Costory suggests the next step in conversation, and you decide whether to go ahead.
Costory notices
Spend on a team, service or account deviates from its baseline.
Costory investigates
01
Get context
Claude calls get_context to learn your dimensions and dashboards.
02
Diff the change
A cost-change diff tree shows which team, service and resource moved.
03
Join events
list_events returns deploys, incidents and provider events from the same window.
04
Act
Save the view, create an alert or log the cause as an event.
Where you see it
Claude
You decide
The owner confirms the cause and decides on a fix.
Why it matters
A spike shows up on a dashboard and the investigation starts: exports, Slack archaeology, guessing which deploy did it. It takes days and often ends without an answer.
Who it’s for
Platform engineers, SREs, FinOps leads
Where it runs
Claude · Slack
What you get
What lands in front of your team
Root cause, not just a number
Who, what and which change.
Minutes, not days
One conversation instead of an export hunt.
Documented
The cause is saved as an event for next time.
Sources and assistants
What it connects
Data sources
Example prompts
Or drive it yourself
Investigate
Why did our AWS bill go up last week? Break it down by team and service, and list any deploys or provider events in the same window.
Close the loop
Log an event explaining the spike and create an alert in case it happens again.
FAQ
Questions about this playbook
Which events can Costory correlate?
GitHub deploys, PR merges and releases, CI/CD events, custom events from the API, and provider events like Savings Plan purchases and SKU price changes.
How fresh is the data?
Costory refreshes billing data every morning. Providers deliver billing exports with some delay, so a change usually shows up within a day or two.
How long does this playbook take to set up?
Connecting your billing data and the Costory MCP takes under 30 minutes with Terraform or CloudFormation. The playbook itself takes minutes: pick the scope, the trigger and the Slack channel. The first billing data lands the next day, and the agent starts from there.
Does Costory change anything in our cloud accounts?
No. Costory reads billing exports and the metrics you connect, and has no write access to your cloud. Actions it takes create Costory objects only: alerts, reports, dashboards and events. Your team stays in control of every change.
Step-by-step guide in the Costory docs
Related playbooks
Run these alongside it
Costory notices
An anomaly is detected, any time of day.
Investigate anomalies in a Slack thread with the FinOps agent
When an alert fires in #finops or a team channel, reply in the thread and the FinOps agent investigates: which team, which service, which deploy.
See the playbook
Costory notices
A deploy is followed by a cost change on the same service.
Cost impact of every deploy, from GitHub events
Capture deploys, PR merges and releases from GitHub or your CI/CD pipeline, and see which ones changed cost.
See the playbook
Costory notices
A new alert is proposed, by you or by the agent.
Backtest a cost alert before it goes live
Preview how often an alert would have fired over the past weeks before turning it on, so alerts stay rare and useful.
See the playbook
Put this playbook on call
Included in every plan, from €250/month. 30-day free trial: connect in under 30 minutes, get your first optimization recommendation the next day.
First optimization recommendation
The next day
ROI
Pays for itself with the first recommendation you act on
Setup
About 30 minutes
Data residency
EU
Access
Read-only on your cloud