Document generation device, document generation method, and program

Abstract

To improve efficiency of a reporting process in incident response and improve reporting accuracy.SOLUTION: Report destination determination means determines a report destination for an incident based on information related to the incident. First prompt acquisition means acquires a basic prompt corresponding to the determined report destination. Second prompt acquisition means acquires an optional prompt based on a condition including the report destination. Prompt generation means combines the basic prompt and the optional prompt to generate a combined prompt. Document generation means inputs the combined prompt into a language model to generate a report document regarding the incident.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates to generating incident report documents. [Background technology]

[0002] In responding to incidents in information systems, when escalation to a superior or reporting to a user is required, it is necessary to select and discard incident information according to the reporting destination and response status, and to consider and compose the text. Patent Document 1 describes a method for generating an incident management report using statistical information on incidents that may be included in management reports generated in the past. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-203909 Summary of the Invention [Problem to be solved by the invention]

[0004] In the method of Patent Document 1, the sentences themselves that are switched depending on the incident analysis are fixed, so the incident status, such as the elapsed time, must be expressed in bullet points. Also, because the report cannot include elements such as a summary that allows the incident status to be understood at a glance, there is a problem that the report document is simple and insufficient.

[0005] One objective of the present disclosure is to improve the efficiency of the reporting process in incident response and to increase the accuracy of reporting. [Means for solving the problem]

[0006] In one aspect of the present disclosure, a document generation device includes: a reporting destination determination means for determining a reporting destination of the incident based on information related to the incident; a first prompt acquisition means for acquiring a basic prompt corresponding to the determined report destination; a second prompt acquisition means for acquiring an option prompt based on a condition including the report destination; a prompt generating means for generating a combined prompt by combining the basic prompt and the optional prompt; a document generation means for inputting the combined prompt into a language model to generate a report document regarding the incident; Equipped with.

[0007] In another aspect of the present disclosure, a computer-implemented method for creating a document comprises: determining where to report the incident based on information related to the incident; Obtain the basic prompt corresponding to the determined reporting destination, Obtaining an optional prompt based on a condition including the report destination; combining the basic prompt and the optional prompt to generate a combined prompt; The combined prompts are input into a language model to generate a written report about the incident.

[0008] In yet another aspect of the disclosure, a program includes: determining where to report the incident based on information related to the incident; Obtain the basic prompt corresponding to the determined reporting destination, Obtaining an optional prompt based on a condition including the report destination; combining the basic prompt and the optional prompt to generate a combined prompt; The combined prompt is input to a language model, causing a computer to perform a process to generate a written report about the incident. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to improve the efficiency of the reporting process in incident response and to increase the accuracy of reporting. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 is a block diagram illustrating a hardware configuration of an incident management server. [Figure 2] FIG. 2 is a block diagram illustrating a functional configuration of an incident management server. [Figure 3] 10 shows an example of an incident management table. [Figure 4] 10 shows an example of an incident statistics management table. [Figure 5] 10 shows an example of an escalation policy management table. [Figure 6] 10 shows an example of a configuration management table. [Figure 7] 10 shows an example of a template management table. [Figure 8] 10 shows an example of a template option management table. [Figure 9] 10 is a flowchart of a report document generation process. [Figure 10] An example of the prompt editing screen is shown below. [Figure 11] 10 is a display example of a report document generation result. [Figure 12] This is an example of a report document assuming an incident escalation. [Figure 13] This is another example of a report document that assumes an incident escalation. [Figure 14] This is an example of a report document assuming user release of an incident. [Figure 15] This is another example of a report document assuming user release of an incident. [Figure 16] FIG. 10 is a block diagram showing the configuration of a document generation device according to a second embodiment. [Figure 17] 10 is a flowchart of a process performed by a document generation device according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, preferred embodiments of the present disclosure will be described with reference to the drawings. <Basic method> Before describing the embodiment, the basic method of this embodiment will be described. The method of this embodiment (hereinafter also referred to as "this method") creates commands (prompts) that change the report content and wording in response to the occurrence of an incident, reflecting the reporting destination (e.g., escalation to a superior or user release), escalation policies (hereinafter also simply referred to as "policies") such as SLAs (Service Level Agreements), and the impact of the incident (e.g., the number of complaints and the amount of losses). This method then applies the prompts to a language model such as LLMs (Large Language Models) to automatically generate an incident report document. Note that an "escalation policy" refers to a policy for determining the need for incident escalation in accordance with the organization and system in operation for effective incident management.

[0012] Specifically, this method has the following features: (1) For reporting destinations that require the application of policies, this method matches information such as the system name, impact, and delivery date assigned to the incident being reported with the policy, and customizes the content of the report document. As a result, this method creates a report document that reflects the defined policy based on the business impact of the incident on the system, the time required to respond, and the compliance status with the SLA.

[0013] (2) When generating a report, this method customizes the report text by taking into account factors that change in real time during incident response, such as the business impact (e.g., SLA compliance status, opportunity loss amount), the number of inquiries and complaints, etc. As a result, this method makes changes to the report text, such as proposing detailed figures on the impact of the incident and recovery plans in the case of escalation, and adding stronger apologies and contact information for inquiries in the case of user release.

[0014] First Embodiment [Hardware configuration] 1 is a block diagram showing the hardware configuration of an incident management server according to the first embodiment. As shown in the figure, the incident management server 1 includes a processor 11, an interface (IF) 12, a read-only memory (ROM) 13, a random access memory (RAM) 14, a database (DB) 15, a recording medium 16, a display device 17, and an input device 18. The components are connected to each other via a bus 19, for example.

[0015] The processor 11 is a computer such as a CPU (Central Processing Unit), and executes a prepared program to control the entire incident management server 1. Specifically, the processor 11 may be a CPU, a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating Point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination of these.

[0016] The processor 11 also loads programs recorded on the ROM 13 or recording medium 16 into the RAM 14 and executes each process coded in the program. The processor 11 functions as part or all of the incident management server 1. The processor 11 executes the report generation process described below.

[0017] The IF 12 transmits and receives data to and from external devices. Specifically, the incident management server 1 receives contacts and reports about incident occurrences from external terminal devices and the like via the IF 12. The incident management server 1 also transmits the created report documents to external devices, such as the terminal devices to which the reports are to be sent, as necessary.

[0018] The ROM 13 stores various programs executed by the processor 11. The RAM 14 is used as a working memory while the processor 11 is executing various processes.

[0019] The DB 15 stores various algorithms, data, machine learning models, AI models, etc. that are used when the incident management server 1 executes the report generation process described below. The DB 15 also stores various data and tables that are used to generate reports, as described below.

[0020] The recording medium 16 is a non-volatile, non-temporary recording medium such as a disk-shaped recording medium or a semiconductor memory. The recording medium 16 may be configured to be detachable from the incident management server 1. The recording medium 16 stores various programs executed by the processor 11.

[0021] The display device 17 is, for example, a liquid crystal display, and displays the operation screen used by the operator when creating a report document, the created report document, etc. The input device 18 is, for example, a keyboard or a mouse, and is used by the operator to give necessary instructions and input data.

[0022] [Function Configuration] 2 shows the functional configuration of the incident management server 1. Functionally, the incident management server 1 comprises an incident management device 10 and a storage device 20.

[0023] The incident management device 10 includes an incident management unit 101, a prompt generation unit 102, a document generation unit 103, and a screen input / output unit 104. The incident management device 10 is realized by the processor 11 shown in FIG. 1 executing a program prepared in advance.

[0024] The storage device 20 includes an incident management table 201, an incident statistics management table 202, an escalation policy management table 203, a configuration management table 204, a template management table 205, and a template option management table 206. The storage device 20 is realized by the DB 15 shown in FIG.

[0025] First, we will explain the incident management device 10. The incident management unit 101 manages incident information such as failure information and inquiries, and the response status thereof. When an operator escalates (reports) an incident, he or she starts a report document generation process using an interface provided by the incident management unit 101.

[0026] The prompt generation unit 102 receives a command to start the report document generation process from the incident management unit 101, and references the incident management table 201, incident statistics management table 202, escalation policy management table 203, configuration management table 204, template management table 205, and template option management table 206 to create a prompt for selecting a report destination and creating a document for each report destination according to the status of the incident. A prompt is generally an instruction statement input to a generative AI, and in this case refers to a sentence that combines a statement instructing the document to be generated and specific information for achieving the instruction. The prompt generation unit 102 inputs the created prompt to the document generation unit 103.

[0027] Before inputting a prompt to the document generation unit 103, the prompt generation unit 102 uses the screen input / output unit 104 to present to the operator a prompt editing screen including the selected report destination, a prompt template for document creation, and optional prompts. The operator checks the presented information and changes the content as necessary to adjust the content of the document to be generated.

[0028] The document generation unit 103 generates a report document in accordance with the prompt created by the prompt generation unit 102. In this embodiment, the document generation unit 103 uses a language model. To improve the accuracy of the generated document, a trained language model may be used that has been generated by additionally training an existing language model using past escalation documents, internal documents of the company that operates the incident management system, and the like.

[0029] The language model used by the document generation unit 103 is also called a large-scale language model (LLM), and is a machine learning model that learns large amounts of text data in advance and is trained to generate text based on input text. The language model learns and models the occurrence probability of sentences and words in natural language, and by using a language model that has been trained with various sentences, conversation data, books, etc., it is possible to perform language processing tasks such as sentence generation, fill-in-the-blank questions, translation, and question answering with high accuracy.

[0030] In this embodiment, the modeling method of the language model to be used is not particularly limited. The language model to be used may be, for example, a well-known model such as BERT (Bidirectional Encoder Representations from Transformers) or GPT (Generative Pre-Training), or may be another model.

[0031] Furthermore, the content generated by the language model is not limited to natural language or characters. For example, the content generated by the language model may generate source code in a programming language, image data, video data, audio data, or other data formats such as JSON for a character string input in a natural language. Furthermore, the content generated by the language model may be a combination of these data, such as a character string and a graph image.

[0032] The screen input / output unit 104 displays incident information acquired by the prompt generation unit 102, a prompt editing screen including prompt templates and option prompts, a report document generated by the document generation unit 103, and the like.

[0033] Next, each table in the storage device 20 will be described. The incident management table 201 is a table that holds information about incidents that have occurred. Fig. 3 shows an example of the incident management table 201. As shown in Fig. 3, the incident management table 201 holds information such as an incident ID 201a indicating a unique number for management purposes, an incident subject 201b, an incident occurrence date and time 201c, a response completion date and time 201d that records the completion of the incident response, a type 102e that indicates the type of incident, a target 201f that indicates the system or device in which the incident occurred, a severity 201g that indicates the response priority of the incident that has occurred and the impact of the occurrence, and a response content 201h that manages the response content for the incident.

[0034] The incident statistics management table 202 is a table that holds statistical information linked to specific incidents. Fig. 4 shows an example of the incident statistics management table 202. As shown in Fig. 4, the incident statistics management table 202 has information such as an ID 202a indicating the management number, an incident ID 202b of the incident to be linked, the number of inquiries for the target incident 202c, the number of complaints for the target incident 202d, and an SLA remaining time 202e indicating the time remaining until an SLA violation occurs when the target incident is a system or device for which an SLA is set.

[0035] The escalation policy management table 203 is a table that holds escalation policy information that is set for the systems and devices that manage incidents. Fig. 5 shows an example of the escalation policy management table 203. As shown in Fig. 5, the escalation policy management table 203 has information such as a policy ID 203a that indicates the management number of the policy, a target 203b that indicates the system or device that is the target of the policy, a condition 203c that indicates the conditions for escalation, and a report destination 203d that indicates the destination to which the escalation will be made.

[0036] The configuration management table 204 is a table that holds configuration information of systems and devices. Fig. 6 shows an example of the configuration management table 204. As shown in Fig. 6, the configuration management table 204 has information such as an ID 204a that indicates the management number of the configuration management information, a target 204b that indicates the target system or device, an SLA 204c that indicates the monthly SLA set for the target system or device, and a stoppage loss amount 204d that indicates the loss amount per unit time if the target system or device stops.

[0037] The template management table 205 is a table that holds report document templates to be passed to the document generation model. Fig. 7 shows an example of the template management table 205. As shown in Fig. 7, the template management table 205 has information such as a template ID 205a indicating the management number of the template, a report destination 205b indicating the escalation destination that uses the template, and a template prompt 205c indicating the template sentence for the prompt. The template prompt is an example of a basic prompt.

[0038] Note that the character string enclosed in <> in the template prompt 205c of the template management table 205 is defined as a replacement character string. Therefore, in practice, the character string is replaced with a specific character string or number using the incident information obtained from the incident management table 201 and the configuration information obtained from the configuration management table 204, and is then passed to the document generation unit 103 as a prompt.

[0039] The template option management table 206 is a table that holds additional command sentences to be added to the template of a report document to be passed to the document generation model. Fig. 8 shows an example of the template option management table 206. As shown in Fig. 8, the template option management table 206 has information such as an option ID 206a indicating the management number of the template option, a target 206b indicating the system or device to which the template option is to be applied, a condition 206c indicating the condition under which the template option is applied, and an option prompt 206d indicating the prompt sentence for the option (optional).

[0040] An "optional prompt" is a prompt that is input to a document generation model and is arbitrarily added to a template prompt. As shown in Figure 7, a template prompt is a prompt that is specified for each incident reporting destination and input to a document generation model to create a report document. In other words, a template prompt is a prompt for generating basic content in a report document. In contrast, as shown in Figure 8, an optional prompt is a prompt that is specified for each condition related to the incident that has occurred and input to a document generation model to generate additional documents that will be added to the report document sent to the reporting destination when those conditions are met. Therefore, depending on the conditions after an incident occurs, only the template prompt may be input to a document generation model, or one or more optional prompts may be added to the template prompt and input to a document generation model.

[0041] Note that the character string enclosed in <> in the option prompt 206d of the template option management table 206 is defined as a replacement character string. Therefore, in practice, the character string is replaced with a specific character string or number using the incident information acquired from the incident management table 201 and the configuration information acquired from the configuration management table 204, and is then passed to the document generation unit 103 as a prompt.

[0042] [Report document generation process] Next, the report generation process will be described. Fig. 9 is a flowchart of the report generation process. This process is realized by the processor 11 shown in Fig. 1 executing a program prepared in advance and operating as the elements shown in Fig. 2.

[0043] First, an operator handling an incident selects the incident they wish to report from the incident management screen provided by the incident management unit 101, and starts the process of generating a report document. Specifically, the operator issues an instruction to start the process of generating a report document using the input device 18. The incident management unit 101 receives the instruction entered by the operator, and the prompt generation unit 102 starts processing in response to the instruction (step S101).

[0044] First, the prompt generation unit 102 acquires incident information to be reported from the incident management table 201 (step S102). Next, based on the incident information acquired from the incident management table 201, the prompt generation unit 102 acquires statistical information associated with the incident from the incident statistics management table 202, acquires configuration information of the incident target from the configuration management table 204, and acquires escalation policy information to be applied from the escalation policy management table 203 (step S103). The statistical information, configuration information, and escalation policy information are examples of information related to the incident.

[0045] Next, the prompt generating unit 102 references the report destination 203d column of the escalation policy information obtained from the escalation policy management table 203, and creates a list of report destinations for the document (step S104).

[0046] Next, the prompt generation unit 102 refers to the list of report destinations created in step S104 and determines whether there are any unprocessed report destinations (step S105). If there are any unprocessed report destinations (step S105: Yes), the process proceeds to step S106. Steps S106 to S108 are processes for acquiring a template prompt and an option prompt for each report destination.

[0047] Specifically, the prompt generation unit 102 selects one unprocessed report destination from the list of report destinations created in step S104 (step S106). Next, the prompt generation unit 102 acquires template information to be applied from the template management table 205 based on the selected report destination (step S107). Next, the prompt generation unit 102 acquires option prompts to be applied from the template option management table 206 based on the incident information acquired in step S102 and the statistical information and configuration information acquired in step S103, and creates a list of option prompts corresponding to the report destination selected in step S106 (step S108). Then, processing returns to step S105. In this way, steps S106 to S108 are executed for each report destination. When template prompts and option prompts have been obtained for all report destinations included in the list created in step S104 (step S105: No), processing proceeds to step S109.

[0048] The prompt generation unit 102 creates a prompt editing screen including a list of template prompts and option prompts obtained in steps S107 and S108 for each report destination in the report destination list created in step S104, and displays the screen on the display device 17 via the screen input / output unit 104 (step S109).

[0049] FIG. 10 shows an example of the prompt editing screen. The prompt editing screen 301 includes a list 301a of template prompts and a list 301b of optional prompts. The incident response operator looks at the displayed prompt editing screen 301 and adds or deletes report destinations and optional prompts as needed. The operator can also temporarily change the text content of the template prompts and optional prompts. Although not shown in FIG. 10, the prompt editing screen 301 may also include other information such as the incident information acquired in step S102 and the statistical information and configuration information acquired in step S103.

[0050] Next, prompt generation unit 102 refers to the list of report destinations created in step S104 and determines whether there are any report destinations for which a report document has not yet been created (step S110). If there are any report destinations for which a report document has not yet been created (step S110: Yes), the process proceeds to step S111. Steps S111 to S113 are processes for creating a report document for each report destination.

[0051] Specifically, the prompt generation unit 102 selects one report destination for which a report document has not yet been created from the list of report destinations created in step S104 (step S111). Next, the prompt generation unit 102 combines the template prompt of the template corresponding to the selected report destination with the contents of all option prompts corresponding to that report destination to create a combined prompt (hereinafter also referred to as a "combined prompt") (step S112).

[0052] The algorithm for combining prompts is not limited to a specific one. For example, the algorithm may be a method of adding information for considering the order of optional prompts to manipulate the order and adding them to the template prompt, or a method of simply adding optional prompts to the end of the template prompt in the order listed.

[0053] The prompt generation unit 102 also replaces the replacement string included in the combined prompt with a specific string or number based on the incident information acquired in step S102, the statistical information acquired in step S103, and the configuration information. The prompt generation unit 102 then passes the created combined prompt to the document generation unit 103.

[0054] The document generation unit 103 generates a report document using a language model based on the combined prompt generated by the prompt generation unit 102 in step S112 (step S113). Then, the process returns to step S110. In this way, steps S111 to S113 are executed for each report destination, and when report documents corresponding to all report destinations have been generated (step S110: No), the screen input / output unit 104 displays the report documents generated for each report destination on the display device 17 (step S114). In this way, the report document generation process ends.

[0055] Figure 11 shows an example of the display of the report document generation results. The incident response operator refers to the displayed report document and makes corrections to the report document as necessary. The operator may also use the document external storage function, such as outputting the report document contents to a file.

[0056] [Example of report document] Next, we will explain examples of report documents that are generated. Figures 12 and 13 are examples of report documents that assume an incident escalation. Figures 12 and 13 were generated from common incident information, with Figure 12 being an example of a report document generated in a situation where an escalation occurred in the early stages of incident response. In contrast, Figure 13 is an example of a report document generated in a situation where the application conditions for the template options have been met more often over time than when Figure 12 was generated. As can be seen by comparing Figures 12 and 13, information such as the number of inquiries and complaints regarding the target incident, and an estimated loss amount, has been added in Figure 13, resulting in a document that reflects changes in the situation of the incident being reported.

[0057] Figures 14 and 15 are examples of report documents that assume an incident will be released to users on a website. Like the examples in Figures 12 and 13, Figures 14 and 15 were generated from common incident information, and Figure 14 is an example of a report document generated in the early stages of incident response. In contrast, Figure 15 is an example of a report document generated in a situation where the application conditions for template options have been met more often over time than when Figure 14 was generated.

[0058] [Example of report generation process] Next, a specific example of the report creation process will be described below: In the following, an example will be described in which steps S102 to S112 of the report creation process shown in Fig. 9 are executed to create the report shown in Fig. 13.

[0059] First, let us assume that the incident to be subjected to the report document generation process is the incident with incident ID "00016" in the incident management table 201 shown in Figure 3, and that the time when the report document generation process is instructed to start is three hours after the date and time of the incident occurrence.

[0060] First, in step S102, the prompt generator 102 acquires incident information for the incident ID "00016" from the incident management table 201.

[0061] Next, in step S103, the prompt generation unit 102 acquires incident statistical information, configuration information of the incident target, and information about the applied escalation policy. For the statistical information, the prompt generation unit 102 references the incident statistics management table 202 in FIG. 4 and acquires data with ID "0023" associated with incident ID "00016." For the configuration information, the prompt generation unit 102 references the configuration management table 204 in FIG. 6 and acquires data with ID "0000" for which the target 204b is "System A." For the escalation policy, the prompt generation unit 102 references the escalation policy management table 203 in FIG. 5 and acquires data with IDs "0000," "0001," and "0002" for which the target is "System A" and which satisfy the condition in condition 203c.

[0062] Next, in step S104, the prompt generator 102 eliminates duplication from the contents of the report destination 203d of the escalation policy IDs "0000," "0001," and "0002," and creates a report destination list "IT manager, executive officer, user."

[0063] Next, in step S105, since the report destination list "IT manager, executive officer, user" has not yet been processed, the prompt generating unit 102 proceeds to step S106.

[0064] In step S106, the prompt generation unit 102 selects one processing target from the report destination list. In this example, it is assumed that the prompt generation unit 102 has selected "executive officer."

[0065] Next, in step S107, the prompt generator 102 refers to the template management table 205 in FIG. 7 and acquires the data for template ID "0001" in which the report destination 205b is "executive officer."

[0066] Next, in step S108, the prompt generation unit 102 refers to the template option management table 206 in Figure 8, obtains data for option IDs "0000," "0001," and "0002" for which the target 206b is "System A" and which satisfies the conditions in condition 206c, and creates a list of that data: "{option ID: 0000, target: ...}, {option ID: 0001, target: ...}, {option ID: 0002, target: ...}."

[0067] Next, the prompt generation unit 102 returns to step S105 and determines any unprocessed report destinations from the report destination list "IT Manager, Executive Officer, User." In this way, the processes of steps S106 to S108 are sequentially performed for the unprocessed "IT Manager" and "User," but a description of these will be omitted. When there are no unprocessed report destinations, the process proceeds to step S109.

[0068] Next, in step S109, the prompt generation unit 102 displays a list including template prompts and option prompts based on the acquired data for each of the report destination lists "IT manager, executive officer, user," i.e., a prompt editing screen as shown in Fig. 10, using the screen input / output unit 104. Here, it is assumed that the contents of the prompt editing screen have been changed by the operator, and generation has been executed with only the report destination "executive officer" remaining.

[0069] Next, in step S110, since no document has yet been generated for the report destination list "executive officer," the prompt generating unit 102 proceeds to step S111.

[0070] Next, in step S111, the prompt generation unit 102 selects one processing target from the list of report recipients. In this example, it is assumed that the prompt generation unit 102 selects "executive officer."

[0071] Next, in step S112, the prompt generation unit 102 combines the content of the template prompt with template ID "0001" with the content of each option prompt 206d in the template option list "{option ID: 0000, target: ...}, {option ID: 0001, target: ...}, {option ID: 0002, target: ...}." The prompt generation unit 102 also replaces the replacement string included in the combined prompt with specific information. In this way, the combined prompt to be input to the language model is generated.

[0072] The combined prompt obtained in this way is input into the language model of the document generation unit 103 to generate a report document, which takes into account the SLA status, which is the content of the option prompt with option ID "0000" of the template option, the estimated amount of opportunity loss with option ID "0001", and the number of inquiries and complaints regarding the incident with option ID "0002", resulting in the generation of a report document like that shown in Figure 13.

[0073] [Effects of this embodiment] According to this embodiment, the number of steps required for reporting an incident can be reduced, and the speed of reporting can be improved.

[0074] Furthermore, according to this embodiment, compared to a method of attaching a bulleted list or an incident management system screen to an escalation report document regarding policy contents such as the severity level assigned to the incident, the elapsed time since response, and SLA information, it is possible to create a report indicating the need for immediate action in a format that is easy for the reader to understand, such as "XX hours have passed, and the SLA annual outage of YY hours is approaching," thereby increasing the effectiveness of escalation.

[0075] Furthermore, according to this embodiment, the quality of escalation can be improved by generating a report that takes into account the business impact of the incident, such as the SLA compliance status and the amount of opportunity loss, as well as dynamic factors related to the incident, such as the number of inquiries and complaints.

[0076] [Variations] Next, modifications of the above embodiment will be described. The following modifications can be applied to the above embodiment in appropriate combinations.

[0077] In the above embodiment, the process of step S101, which triggers the creation of a report document, may be automatically executed by the incident management system when an update of incident information such as elapsed time or severity is triggered. Alternatively, a schedule may be set so that the incident management system periodically executes the process of step S101. Alternatively, the process of step S101 may be executed by another device such as a monitoring system or a job execution system.

[0078] In the above embodiment, the process of step S115 for finally outputting the generated report document may be performed by sending the generated document directly to a person or an application using a means such as email or WebAPI.

[0079] Second Embodiment 16 is a block diagram showing the functional configuration of a document generation device according to the second embodiment. A document generation device 70 according to the second embodiment includes a report destination determination unit 71, a first prompt acquisition unit 72, a second prompt acquisition unit 73, a prompt generation unit 74, and a document generation unit 75.

[0080] 17 is a flowchart of processing by the document generation device of the second embodiment. The report destination determination means 71 determines a report destination for the incident based on information related to the incident (step S71). The first prompt acquisition means 72 acquires a basic prompt corresponding to the determined report destination (step S72). The second prompt acquisition means 73 acquires an optional prompt based on conditions including the report destination (step S73). The prompt generation means 74 combines the basic prompt and the optional prompt to generate a combined prompt (step S74). The document generation means 75 inputs the combined prompt into a language model and generates a report document related to the incident (step S75).

[0081] According to the document generation device 70 of the second embodiment, it is possible to improve the efficiency of the reporting process in incident response and also improve the accuracy of reporting.

[0082] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0083] (Appendix 1) a reporting destination determination means for determining a reporting destination of the incident based on information related to the incident; a first prompt acquisition means for acquiring a basic prompt corresponding to the determined report destination; a second prompt acquisition means for acquiring an option prompt based on a condition including the report destination; a prompt generating means for generating a combined prompt by combining the basic prompt and the optional prompt; a document generation means for inputting the combined prompt into a language model to generate a report document regarding the incident; A document generation device comprising:

[0084] (Appendix 2) the conditions include a condition regarding the severity of the incident; 2. The document generation device according to claim 1, wherein the second prompt acquisition means acquires the severity of the incident from information related to the incident, and acquires the optional prompt based on the condition.

[0085] (Appendix 3) the condition includes a condition regarding the amount of time that has elapsed since the occurrence of the incident; 2. The document generation device according to claim 1, wherein the second prompt acquisition means acquires the elapsed time from information related to the incident, and acquires the optional prompt based on the condition.

[0086] (Appendix 4) The information related to the incident includes statistical information including at least one of the number of inquiries, the number of complaints, and the remaining time of the SLA related to the incident; the conditions include conditions related to the statistical information, 2. The document generation device according to claim 1, wherein the second prompt acquisition means acquires the statistical information from information related to the incident, and acquires the option prompt based on the condition.

[0087] (Appendix 5) a storage unit that stores a first table that defines basic prompts in association with the report destinations; 2. The document generation device according to claim 1, wherein the first prompt acquisition means refers to the first table and acquires the basic prompt for each determined report destination.

[0088] (Appendix 6) the storage unit stores a second table that defines optional prompts in association with the conditions; 6. The document generation device according to claim 5, wherein the second prompt acquisition means refers to the second table and acquires the optional prompt corresponding to the condition.

[0089] (Appendix 7) 2. The document generation device according to claim 1, wherein the prompt generation means replaces a replacement string included in the basic prompt and the optional prompt with a string or number included in information related to the incident.

[0090] (Appendix 8) 1. A computer-implemented method for creating documents, comprising: determining where to report the incident based on information related to the incident; Obtain the basic prompt corresponding to the determined reporting destination, Obtaining an optional prompt based on a condition including the report destination; combining the basic prompt and the optional prompt to generate a combined prompt; A document generation method for generating a report document regarding the incident by inputting the combined prompt into a language model.

[0091] (Appendix 9) determining where to report the incident based on information related to the incident; Obtain the basic prompt corresponding to the determined reporting destination, Obtaining an optional prompt based on a condition including the report destination; combining the basic prompt and the optional prompt to generate a combined prompt; A program that causes a computer to execute a process of inputting the combined prompt into a language model and generating a report document regarding the incident.

[0092] Although the present disclosure has been described above with reference to the embodiments and examples, the present disclosure is not limited to the above-described embodiments and examples. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. [Explanation of symbols]

[0093] 10 Incident Management Device 11 processors 20 Storage device 101 Incident Management Department 102 Prompt Generation Unit 103 Document Generation Unit 104 Screen input / output unit 201 Incident Management Table 202 Incident Statistics Management Table 203 Escalation Policy Management Table 204 Configuration Management Table 205 Template Management Table 206 Template Option Management Table

Claims

1. a reporting destination determination means for determining a reporting destination of the incident based on information related to the incident; a first prompt acquisition means for acquiring a basic prompt corresponding to the determined report destination; a second prompt acquisition means for acquiring an option prompt based on a condition including the report destination; a prompt generating means for generating a combined prompt by combining the basic prompt and the optional prompt; a document generation means for inputting the combined prompt into a language model to generate a report document regarding the incident; A document generation device comprising:

2. the conditions include a condition regarding the severity of the incident; 2. The document generation device according to claim 1, wherein the second prompt acquisition means acquires the severity of the incident from information related to the incident, and acquires the option prompt based on the condition.

3. the condition includes a condition regarding the amount of time that has elapsed since the occurrence of the incident; 2. The document generation device according to claim 1, wherein the second prompt acquisition means acquires the elapsed time from information related to the incident, and acquires the option prompt based on the condition.

4. The information related to the incident includes statistical information including at least one of the number of inquiries, the number of complaints, and the remaining time of the SLA related to the incident; the conditions include conditions related to the statistical information, 2. The document generation device according to claim 1, wherein the second prompt acquisition means acquires the statistical information from information related to the incident, and acquires the option prompt based on the condition.

5. a storage unit that stores a first table that defines basic prompts in association with the report destinations; 2. The document generation device according to claim 1, wherein the first prompt acquisition means refers to the first table and acquires the basic prompt for each determined report destination.

6. the storage unit stores a second table that defines optional prompts in association with the conditions; 6. The document generation device according to claim 5, wherein the second prompt acquisition means refers to the second table and acquires the option prompt corresponding to the condition.

7. 2. The document generation device according to claim 1, wherein the prompt generation means replaces substitution character strings included in the basic prompt and the optional prompt with character strings or numbers included in the information related to the incident.

8. 1. A computer-implemented method for creating documents, comprising: determining where to report the incident based on information related to the incident; Obtain the basic prompt corresponding to the determined reporting destination, Obtaining an optional prompt based on a condition including the report destination; combining the basic prompt and the optional prompt to generate a combined prompt; A document generation method for generating a report document regarding the incident by inputting the combined prompt into a language model.

9. determining where to report the incident based on information related to the incident; Obtain the basic prompt corresponding to the determined reporting destination, Obtaining an optional prompt based on a condition including the report destination; combining the basic prompt and the optional prompt to generate a combined prompt; A program that causes a computer to execute a process of inputting the combined prompt into a language model and generating a report document regarding the incident.

Images