Investigate anomalies in a Slack thread with the FinOps agent
When an alert fires in #finops or a team channel, reply in the thread and the FinOps agent investigates: which team, which service, which deploy.
Runs in
Slack
First optimization recommendation
The next day
ROI
Pays for itself with the first recommendation you act on
# finops
Costory
APP
Alert: BigQuery spend +38% vs the trailing 7 days. In thread: 82% of the increase comes from the analytics-exports project, driven by a new scheduled query deployed Tuesday (PR #4182). Other projects are flat.
The owning team agrees on the fix in the thread; the agent follows up until it's resolved.
Playbook
What the agent does
From what Costory notices to what you decide. Costory suggests the next step in conversation, and you decide whether to go ahead.
Costory notices
An anomaly is detected, any time of day.
Costory investigates
01
The alert lands in the channel
Cost alerts post to the channel of your choice, such as #finops or #team-data.
02
Ask in the thread
Mention the agent in the thread and ask why.
03
The agent investigates
It breaks the change down by dimension and pulls related events and usage.
04
Decide together
The team agrees on a fix; the agent can log the cause as an event.
Where you see it
Slack · #team-data
You decide
The owning team agrees on the fix in the thread; the agent follows up until it's resolved.
Why it matters
Alerts that only say 'cost is up 30%' create noise. The useful part, the why, usually needs someone to open three tools.
Who it’s for
On-call engineers, platform teams, FinOps leads
Where it runs
Slack
What you get
What lands in front of your team
Answers where the alert is
No context switch to another tool.
A shared investigation
The whole channel sees the reasoning.
A documented cause
Explanations saved as events.
Sources and assistants
What it connects
Data sources
Example prompts
Or drive it yourself
Follow up
@Costory is this a one-off or a new baseline? Compare with the same weekday last month.
FAQ
Questions about this playbook
Can the agent read all our Slack messages?
No. Costory only works in channels where the bot has been invited; it does not auto-join channels.
Which channels can alerts go to?
Any Slack channel where the Costory bot is present, plus Microsoft Teams channels and email.
How fresh is the data?
Costory refreshes billing data every morning. Providers deliver billing exports with some delay, so a change usually shows up within a day or two.
Does Costory change anything in our cloud accounts?
No. Costory reads billing exports and the metrics you connect, and has no write access to your cloud. Actions it takes create Costory objects only: alerts, reports, dashboards and events. Your team stays in control of every change.
Step-by-step guide in the Costory docs
Related playbooks
Run these alongside it
Costory notices
Spend on a team, service or account deviates from its baseline.
Investigate a cost spike and find the deploy behind it
When spend moves, the agent finds the deploy, team and service behind it, checks incidents and provider events from the same window, and posts the likely cause.
See the playbook
Costory notices
Every Monday at 9:00, for each team.
Weekly showback per team, posted in each team's Slack channel
Every engineering team gets its own weekly cost report in its own Slack channel, scoped to the services it owns.
See the playbook
Costory notices
A team's spend deviates from its baseline.
Route cost alerts to the owning team's channel
Each team gets its own alerts in its own Slack or Teams channel, scoped to the services it owns.
See the playbook
Put this playbook on call
Included in every plan, from €250/month. 30-day free trial: connect in under 30 minutes, get your first optimization recommendation the next day.
First optimization recommendation
The next day
ROI
Pays for itself with the first recommendation you act on
Setup
About 30 minutes
Data residency
EU
Access
Read-only on your cloud