4
IFO4
Sign InJoin IFO4
AgentaaS OS
Cost Anomaly Response Playbook
Phase 1
Step 1/6
00:00
0/650
✕ Exit
AgentaaS OS
IFO4 PLAYGROUND
P1
1
Simultaneous Triage - 3 Alerts
P2
2
Engage AWS Shield for DDoS
P3
3
Root Cause the S3 Lifecycle Failure
P4
4
Resolve the Orphaned NAT Gateway
P5
5
Build Cost Anomaly Prevention Controls
P6
6
Write the Post-Incident FinOps Report
Initiatives7
Capital Under Change$9.4M
Health Score61/100
Waste %24.8%
Value at Risk$7.6M
Phase 1: Triage
Simultaneous Triage - 3 Alerts
WARROOM50 pts
Critical
2
Active alerts
Warning
1
Active alerts
Info
0
Monitoring
Alert Stream
nowData transfer +$23,400 - potential DDoS attack in progress
critical
nowS3 lifecycle policy failure - $18K unexpected storage charges
critical
nowOrphaned NAT Gateway - $8,200/month, no owner
warning
Risk Matrix
2
3
4
6
SITUATION

Three alerts, one incident channel. You need to triage in order of urgency. The DDoS is ACTIVE - charges growing at $420/hour. The S3 issue already happened - $18K charged, lifecycle is now fixed by the data team. The NAT Gateway has been running for 3 months - $8,200/month ongoing waste.

Health
61/100
Waste
24.8%
Spend
$178K/mo
Savings
$14K
AGENT INSIGHT

Drift Sentinel: DDoS mitigation via AWS Shield Standard is available immediately. Shield Advanced requires enrollment but provides automatic DDoS cost protection credits.

DECISION REQUIRED

In what order do you address these three alerts?

Hint: Incident triage: prioritize by ongoing financial impact rate, not sunk cost.