Agent - Token / cost anomaly by model dimension

Agent Cost Anomaly By Dimension

Query

let lookback = 14d;
let step = 1h;
let recentWindow = 1d;
AppDependencies
| where TimeGenerated > ago(lookback)
| where isnotempty(Properties["gen_ai.usage.input_tokens"])
     or isnotempty(Properties["gen_ai.usage.output_tokens"])
| extend
    Model  = tostring(Properties["gen_ai.request.model"]),
    InTok  = tolong(Properties["gen_ai.usage.input_tokens"]),
    OutTok = tolong(Properties["gen_ai.usage.output_tokens"])
| extend Model = iff(isempty(Model), "unknown-model", Model)
| extend TotalTok = coalesce(InTok, 0) + coalesce(OutTok, 0)
| make-series Tokens = sum(TotalTok) default = 0
    on TimeGenerated from ago(lookback) to now() step step by Model
| extend (anom, score, baseline) = series_decompose_anomalies(Tokens, 2.5)
| mv-expand
    TimeGenerated to typeof(datetime),
    Tokens   to typeof(long),
    anom     to typeof(long),
    score    to typeof(double),
    baseline to typeof(long)
| where anom == 1 and Tokens > baseline and TimeGenerated > ago(recentWindow)
| project TimeGenerated, Model, Tokens, BaselineTokens = baseline, AnomalyScore = score
| order by AnomalyScore desc

Explanation

This query is designed to identify unusual patterns in token usage for different AI models over a 14-day period. Here's a simple breakdown:

Purpose: The query aims to detect anomalies in the number of tokens consumed by AI models, which could indicate unusual or unexpected costs associated with specific models.
Data Source: It pulls data from the AppDependencies table, specifically looking at input and output tokens used by AI models.
Time Frame: It examines data from the past 14 days, with a focus on hourly intervals.
Anomaly Detection: The query uses a function called series_decompose_anomalies to identify anomalies in token usage. An anomaly is flagged if the token usage is significantly higher than the baseline (normal usage pattern).
Filtering: It only considers anomalies that occurred within the last day and where the token usage exceeded the baseline.
Output: The results include the time of the anomaly, the model affected, the number of tokens used, the baseline token usage, and an anomaly score. The results are sorted by the anomaly score in descending order, highlighting the most significant anomalies.
Customization: The query can be adjusted to group data by different dimensions (like agent or tool) and to change the sensitivity of anomaly detection.

Overall, this query helps in identifying cost anomalies related to AI model usage, which might otherwise go unnoticed if spread across multiple agents.

Details

David Alonso

Released: June 8, 2026

Tables

AppDependencies

Keywords

AppDependenciesPropertiesModelTokensTimeGeneratedAnomalyScoreBaselineTokens

Operators

letagowhereisnotemptyextendtostringtolongiffisemptycoalescemake-seriessumseries_decompose_anomaliesmv-expandtypeofprojectorder by

Tactics

Impact

MITRE Techniques

T1496

Actions

GitHub

KQL Search