In my opinion, I think what you might be encountering is how anomaly is defined.
By Cloudability's definition, an anomaly is for a single set of tag values, account and service. If you click on 'View Report' for any given anomaly, you will see all the filters applied to the alert. Here is an example of a 'false' anomaly value we sometimes encounter: we have some legacy tag keys we decided to discontinue, but still exist on some resources. we may receive an anomaly alert for a much lesser value than expected- because the anomaly is separating just those resources with the legacy tag keys we have. we could get a separate alert of resources where that tag key does not exist for the same application or view. We should get rid of those legacy tag keys (add that to my list of things to do :) )
I agree with you that Anomalies should also be reported on cost drops! We added that as a feature request- hope we can get others to do the same.
Another feature request would be to 'squelch' false flags. Stop alerting me about the application that spins up at the end of the month to do month end reports :)
#Cloudability