Incident response creation system, incident response creation method, and incident response creation program

Abstract

To propose an appropriate incident response when an unknown incident occurs.SOLUTION: An incident response creation system includes: an incident information acquisition unit which acquires incident information of a target system; an equipment information acquisition unit which acquires equipment information of the target system; a degree-of-conformity calculation unit which calculates a degree of conformity of each of a plurality of incident responses with respect to the incident information and the equipment information; a selection unit which selects one of the incident responses based on the degrees of conformity; an incident definition unit which defines an unknown incident when the highest degree of conformity out of the degrees of conformity calculated by the degree-of-conformity calculation unit does not reach a threshold, based on the incident information acquired by the incident information acquisition unit; and a creation unit which creates an incident response based on the unknown incident defined by the incident definition unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an incident response creation system, an incident response creation method, and an incident response creation program. [Background technology]

[0002] Conventionally, techniques for creating incident responses, which are incident response procedures for dealing with incidents in a target system, have been known. Conventional systems that propose incident responses provide users with incident responses based on incidents detected from logs acquired from the target system and configuration data of the target system. For example, a computer system described in Patent Literature 1 uses a management server to perform the following processes: problem detection, cause location identification, generation of proposed countermeasure procedures, evaluation of proposed countermeasure procedures, prioritization of proposed countermeasure procedures, presentation of proposed countermeasure procedures, administrator selection, and execution of proposed countermeasure procedures. Furthermore, in this computer system, the evaluation of proposed countermeasure procedures involves simulating and evaluating the effects of one or more proposed countermeasure procedures, or receiving and evaluating values ​​manually calculated by the administrator. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2017-026017 Summary of the Invention [Problem to be solved by the invention]

[0004] In the computer system described above, even if a response procedure was proposed when an unknown problem occurred that was not registered as a problem, cause, or configuration data, there was a possibility that the proposed response procedure would not be appropriate.

[0005] The present disclosure has been made in consideration of the above circumstances, and aims to provide an incident response creation system, an incident response creation method, and an incident response creation program that can propose an appropriate incident response when an unknown incident occurs. [Means for solving the problem]

[0006] The present disclosure has been made to solve the above-mentioned problems, and one aspect of the present disclosure is an incident response creation system comprising: an incident information acquisition unit that acquires incident information indicating an incident in a target system; an equipment information acquisition unit that acquires equipment information indicating equipment included in the target system; a compatibility calculation unit that calculates the compatibility of the incident information and each of a plurality of incident responses with the equipment information; a selection unit that selects one of a plurality of incident responses based on the multiple compatibility degrees calculated by the compatibility calculation unit; an incident definition unit that defines an unknown incident based on the incident information acquired by the incident information acquisition unit if the highest compatibility degree among the multiple compatibility degrees calculated by the compatibility calculation unit does not reach a threshold value; and a creation unit that creates an incident response based on the unknown incident defined by the incident definition unit.

[0007] Another aspect of the present disclosure is an incident response creation method including: an incident response creation system acquiring incident information indicating an incident in a target system and equipment information indicating equipment included in the target system; the incident response creation system calculating a degree of conformance of each of a plurality of incident responses to the incident information and the equipment information; the incident response creation system selecting an incident response from a plurality of incident responses based on the plurality of degrees of conformance; the incident response creation system defining an unknown incident based on the incident information if the highest degree of conformance among the plurality of degrees of conformance does not reach a threshold; and the incident response creation system creating an incident response based on the unknown incident.

[0008] Another aspect of the present disclosure is an incident response creation program that executes, on a computer of an incident response creation system, the steps of acquiring incident information indicating an incident in a target system and equipment information indicating equipment included in the target system; calculating the compatibility of each of a plurality of incident responses with the incident information and the equipment information; selecting one of a plurality of incident responses based on the multiple compatibility levels; if the highest compatibility level among the plurality of compatibility levels does not reach a threshold, defining an unknown incident based on the incident information; and creating an incident response based on the unknown incident. [Effects of the Invention]

[0009] According to one aspect of the present invention, it is possible to propose an appropriate incident response when an unknown incident occurs. [Brief explanation of the drawings]

[0010] [Figure 1]1 is a block diagram showing an example of an incident response generation system 100 according to an embodiment. [Figure 2] 10 is a diagram for explaining the learning process performed by the fitness learning unit 116 in the embodiment. FIG. [Figure 3] FIG. 10 is a diagram illustrating an example of an incident table according to an embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a work item table according to the embodiment. [Figure 5] FIG. 10 is a diagram illustrating an example of an incident response table according to an embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of an incident response according to an embodiment. [Figure 7] FIG. 10 is a diagram illustrating another example of an incident response according to an embodiment. [Figure 8] 1 is a flowchart showing an example of a processing procedure of an incident response generation system 100 according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] An incident response generation system, an incident response generation method, and an incident response generation program to which the present invention is applied will be described below with reference to the drawings.

[0012] 1 is a block diagram showing an example of an incident response generation system 100 according to an embodiment. The incident response generation system 100 according to the embodiment is connected to a target system 200, a responder terminal device 300, and an administrator terminal device 310 via, for example, a communication network. The communication network may include, for example, a general-purpose network such as the Internet, and a private network such as local 5G or Wi-Fi (registered trademark).

[0013] The target system 200 is, for example, a system including a server device, a database, and network equipment, etc. As long as the configuration of the target system 200 is known in advance, it may be, for example, a service providing system that provides various web services, a system installed in a building facility, or an infrastructure facility including a large number of facilities.

[0014] The incident response creation system 100 is an information processing system that has the function of acquiring incident information indicating an incident in the target system 200 and creating an incident response based on the incident. An incident is a problem that occurs in the operation or information management of the target system 200. An incident is, for example, unauthorized access or a cyber attack. An incident response is an incident response procedure that indicates the steps that must be taken to resolve an incident that has occurred in the target system 200.

[0015] The incident response creation system 100 includes, for example, a log database 102, an incident detection unit 104, an incident information acquisition unit 106, a goodness-of-fit calculation unit 108, a selection unit 110, an output unit 112, an evaluation unit 114, a goodness-of-fit learning unit 116, an incident definition notification unit 118, an input information database 120, an incident definition unit 122, an incident response creation unit 124, and an incident response modification unit 126. Each unit in the incident response creation system 100 may be included in a single information processing device, or may be distributed across multiple information processing devices. For example, each unit in the incident response creation system 100 may be a separate server device.

[0016] The incident detection unit 104, incident information acquisition unit 106, goodness-of-fit calculation unit 108, selection unit 110, output unit 112, evaluation unit 114, goodness-of-fit learning unit 116, incident definition notification unit 118, incident definition unit 122, incident response creation unit 124, and incident response modification unit 126 are realized, for example, by a processor such as a CPU (Central Processing Unit) provided in one or more information processing devices executing an incident response creation program stored in program memory. The log database 102 and input information database 120 are, for example, information storage devices such as HDDs, flash memory, or RAM (Random Access Memory), and may also be NAS (Network Attached Storage) devices accessible by the incident response creation system 100 via a communication network.

[0017] The log database 102 receives log information output from the target system 200 and accumulates it in the log database. The log information is subjected to preprocessing related to natural language processing, for example, in order to input it to the compatibility calculation unit 108. The log information may include information for tracking the location of an error in the target system 200, or may be unstructured information. The information for tracking the location of an error and unstructured information are deleted from the log information. The log database 102 stores facility information corresponding to the log information. The facility information is information indicating the facilities included in the target system 200.

[0018] The incident detection unit 104 detects an incident in the target system 200 based on the log information accumulated in the log database 102. The incident detection unit 104 detects an incident by comparing the information stored in an incident table (FIG. 3, which will be described later) with the log information accumulated in the log database 102.

[0019] The incident information acquisition unit 106 acquires incident information when an incident is detected by the incident detection unit 104. The incident information is information that indicates an incident in the target system 200. The incident information acquisition unit 106 also acquires facility information corresponding to the incident information. The incident information acquisition unit 106 also functions as a facility information acquisition unit.

[0020] The compatibility calculation unit 108 calculates the compatibility of each of the multiple incident responses with respect to the incident information and facility information. The compatibility calculation unit 108 may calculate the compatibility using a compatibility calculation model 108A. The compatibility calculation model 108A is a machine learning model trained using the incident information, facility information of the target system 200, the incident responses, and the compatibility. The compatibility calculation unit 108 inputs the incident information acquired by the incident information acquisition unit 106, equipment information of the target system in which the incident occurred, and multiple incident responses into the compatibility calculation model 108A, and calculates the compatibility for the incident response based on the output of the compatibility calculation model 108A.

[0021] The selection unit 110 selects one of the multiple incident responses based on the multiple degrees of relevance calculated by the relevance calculation unit 108. The selection unit 110 may select the incident response with the highest degree of relevance. The selection unit 110 may select multiple incident responses whose degrees of relevance exceed a threshold. The selection unit 110 outputs the selected incident response to the output unit 112. If the highest degree of relevance among the multiple degrees of relevance calculated by the relevance calculation unit 108 does not reach the threshold, the selection unit 110 notifies the incident definition notification unit 118.

[0022] The output unit 112 outputs the incident information and information indicating the incident response to the responder terminal device 300. If the highest degree of suitability among the multiple degrees of suitability calculated by the suitability calculation unit 108 does not reach the threshold, the selection unit 110 notifies the incident definition notification unit 118.

[0023] The evaluation unit 114 acquires evaluation information indicating the evaluation of the incident response output by the output unit 112. The evaluation information is information based on the results of an evaluation of the incident response by the person who implemented the incident response. The evaluation information may be a score or a satisfaction level according to an input operation by the responder who implemented the incident response. The evaluation unit 114 may acquire evaluation information indicating evaluations by persons other than the person who performed the incident response. For example, the evaluation unit 114 may acquire evaluations by the owner of the target system 200 or the administrator who operates the administrator terminal device 310.

[0024] The evaluation unit 114 outputs the incident information, incident response information, and evaluation information to the suitability learning unit 116. The suitability learning unit 116 trains the suitability calculation model 108A so as to output a suitability corresponding to the evaluation information. In this way, the suitability learning unit 116 trains the suitability calculation model 108A so as to output an incident response with a higher suitability when the incident response is highly evaluated by the person who responded to the incident.

[0025] If the highest degree of conformance among the multiple degrees of conformance calculated by the conformance calculation unit 108 does not reach a threshold value, the incident definition notification unit 118 notifies the administrator terminal device 310 of information requesting the definition of an unknown incident.

[0026] The input information database 120 stores, for example, an incident table, a work item table, and an incident response table. The incident table stores multiple pieces of incident information corresponding to multiple incidents. The work item table stores multiple work items included in an incident response. The incident response stores multiple pieces of incident response information. The incident response information is information indicating an incident response that includes multiple work items.

[0027] If the highest degree of conformance among the multiple degrees of conformance calculated by the conformance calculation unit 108 does not reach the threshold value, the incident definition unit 122 defines an unknown incident based on the incident information acquired by the incident information acquisition unit 106. The incident definition unit 122 defines an unknown incident based on a request received from the administrator terminal device 310. The process of defining an unknown incident is a process of registering information indicating a new unknown incident by inserting a row into the incident table.

[0028] The incident response creation unit 124 creates an incident response based on the unknown incident defined by the incident definition unit 122. The incident response creation unit 124 acquires incident information for the unknown incident by referencing the incident table and extracts work items for resolving the unknown incident from the work item table. The incident response creation unit 124 creates the incident response by rearranging the extracted work items in the order of work. The incident response creation unit 124 may create the incident response using, for example, existing computer software. The incident response creation unit 124 registers incident response information indicating the created incident response in the incident response table and transmits the registered incident response information to the administrator terminal device 310.

[0029] The incident response modifier 126 modifies the incident responses registered in the incident response table based on incident response modification information acquired from the administrator terminal device 310. The process of modifying an incident response includes, for example, adding an action item to a row in the incident response table or changing the content of the action item. This allows the incident response modifier 126 to modify an incident response for an unknown incident that was automatically created by the incident response creator 124 based on an administrator's operation.

[0030] The incident response generation system 100 may modify the work items stored in the work item table and may add new work items to the work item table based on operations of the administrator terminal device 310. For example, if an effective work item is added to resolve an unknown incident, the incident response generation unit 124 can include the newly added work item in the incident response for the unknown incident.

[0031] FIG. 2 is a diagram for explaining the learning process performed by the fitness learning unit 116 in the embodiment. The goodness-of-fit learning unit 116 trains the goodness-of-fit calculation model 108A using incident information indicating an unknown incident, facility information, and incident response information for the unknown incident as learning data. When incident information and facility information indicating an unknown incident are input to the goodness-of-fit calculation model 108A, the goodness-of-fit learning unit 116 updates parameters for adjusting the inference of the goodness-of-fit calculation model 108A based on the output of the goodness-of-fit calculation model 108A. In this way, the goodness-of-fit learning unit 116 trains the goodness-of-fit calculation model 108A so that it outputs incident response information for an unknown incident and a goodness of fit equal to or greater than a reference value. A goodness of fit equal to or greater than the reference value is a goodness of fit that allows the selection unit 110 to select the incident response created by the incident response creation unit 124 even if multiple incident responses are output for an unknown incident.

[0032] As described above, the relevance learning unit 116 may use the evaluation information acquired by the evaluation unit 114 as learning data. The relevance learning unit 116 inputs the incident information, incident response information, and evaluation information into the relevance calculation model 108A for learning. In this way, the relevance learning unit 116 can train the relevance calculation model 108A so that the higher the evaluation of the incident information and the incident response information, the higher the relevance to be output.

[0033] The fitness learning unit 116 may use other data to learn the fitness calculation model 108A. The evaluation unit 114 may acquire, as evaluation information, information indicating the number of times an incident response has been used for an incident. The relevance learning unit 116 trains the relevance calculation model 108A using the incident information, incident response information, relevance, and information indicating the number of times the response has been used. As a result, the relevance calculation model 108A is trained to output a higher relevance for an incident response that has been used more frequently for an incident.

[0034] The relevance learning unit 116 may use the similarity between incidents as learning data in the learning process of the relevance calculation model 108A. The similarity between incidents increases as the number of commonalities between the incidents increases, such as the commonality of the target systems 200 and the commonality of the incident types. When there is a first incident response with high relevance for a known first incident, the relevance learning unit 116 may train the relevance calculation model 108A so as to increase the relevance of the first incident response for an unknown incident similar to the first incident. In this way, the relevance learning unit 116 can, for example, cause the selection unit 110 to select a first incident response for an unknown incident. Furthermore, the relevance learning unit 116 can cause the selection unit 110 to select multiple incident responses for an incident with a low occurrence frequency.

[0035] The goodness-of-fit learning unit 116 may use information indicating the number of work items in the incident response as learning data. The goodness-of-fit learning unit 116 inputs the incident information, incident response information, and the number of work items into the goodness-of-fit calculation model 108A for learning. In this way, the goodness-of-fit learning unit 116 can train the goodness-of-fit calculation model 108A so that the fewer the number of work items for the incident information and incident response information, the higher the goodness-of-fit output.

[0036] FIG. 3 is a diagram illustrating an example of an incident table according to the embodiment. The incident table is table data in which incident information is registered for each row. The incident table is information in which, for example, each row associates an incident number, title information indicating the name of the incident, log content information indicating the content of the log information, occurrence log information corresponding to the log information, and condition information indicating the conditions under which the incident occurred. The incident table registers existing incidents such as database outages, HTTP request outages, and ping outages. Incident information indicating unknown incidents is registered in the incident table by the incident definition unit 122.

[0037] The incident detection unit 104 extracts log information registered in the log database 102 and determines whether the extracted log information corresponds to the log content information, occurrence log information, and condition information registered for each number. If the extracted log information corresponds to the log content information, occurrence log information, and condition information, the incident detection unit 104 outputs the corresponding number in the incident table or the log information as incident information to the incident information acquisition unit 106.

[0038] FIG. 4 is a diagram illustrating an example of a work item table according to the embodiment. The work item table is information that associates, for example, a number, response information indicating the content of the work response, target information indicating the target of the work, stoppability information indicating whether the work can be stopped when being performed, configuration information corresponding to equipment information, one or more pieces of incident information that have occurred, and next work information indicating the next work item.

[0039] For example, when an unknown incident is registered in the incident table, the incident response creation unit 124 determines whether an occurred incident corresponding to the unknown incident is registered in the work item table. If there is an occurred incident corresponding to the unknown incident, the incident response creation unit 124 extracts the work item corresponding to the occurred incident. If the extracted work item has a next task, the incident response creation unit 124 extracts the work item corresponding to the next task. This allows the incident response creation unit 124 to extract multiple work items for responding to the unknown incident.

[0040] FIG. 5 is a diagram illustrating an example of an incident response table according to the embodiment. The incident response table is, for example, information that associates an incident response number, a title indicating the name of the incident response, and one or more nodes. One or more nodes are information that arranges the work items included in the incident response in the order of the work. For example, in the incident response table, the next work item after work item No. 2' in FIG. 4 is No. 5, and the next work item after work item No. 5 is No. 6 or No. 2, so the items are arranged in the order of node 2, node 5, and node 6.

[0041] FIG. 6 is a diagram illustrating an example of an incident response according to the embodiment. The incident response indicates that work items are performed in the order of node 2, node 5, node 6, and node 4, and that work at node 2 and node 5 is repeated until work at node 5 is completed. For example, if an incident of an HTTP request not being received occurs as shown by number 2 in Fig. 3, the incident response creation unit 124 selects the work item with number 2 (node ​​2) in Fig. 4, selects the work item with number 5 (node ​​5) as the next work item, selects the work item with number 6 (node ​​6) or the work item with number 2 (node ​​2) as the next work item, and selects the work item with number 4 (node ​​4) as the next work item. In this way, the incident response creation unit 124 can create the incident response shown in Fig. 6.

[0042] FIG. 7 is a diagram illustrating another example of an incident response according to the embodiment. The incident response indicates that the work items are performed in the order of node 7, node 8, node 3' and node 4', and node 9, and then depending on the results of the work at node 8, nodes 3' and 4' are performed as nested parts, and finally the work item at node 9 is performed. For example, suppose the incident response is "Handling a problem with XX application" numbered 2' in Fig. 4. In this case, the incident response creation unit 124 can create an incident response in which work items are performed in the order of node 7, node 8, node 3', node 4', and node 9. Nodes 3' and 4' each contain two nodes, and are defined as nested parts that are swapped depending on the work result of node 8.

[0043] FIG. 8 is a flowchart showing an example of a processing procedure of the incident response generation system 100 according to the embodiment. First, the incident detection unit 104 detects the occurrence of an incident in the target system 200 based on the log information accumulated in the log database 102 (step S100). The incident information acquisition unit 106 acquires incident information and facility information indicating the detected incident.

[0044] The compatibility calculation unit 108 calculates the compatibility between the incident that has occurred and the known incident responses based on the incident information and facility information acquired by the incident information acquisition unit 106 (step S102). The selection unit 110 determines whether the highest compatibility among the compatibility of the known incident responses exceeds a threshold (step S104).

[0045] If the highest degree of suitability among the known incident responses exceeds the threshold (step S104: YES), the selection unit 110 selects 1 to N incident responses in descending order of degree of suitability (step S106).The selection unit 110 proposes an incident response by outputting the selected 1 to N incident responses from the output unit 112 (step S108).

[0046] The incident response output from the output unit 112 is displayed on the responder terminal device 300, and the responder handles the incident using the incident response (step S110). In response to receiving an operation from the responder, the responder terminal device 300 acquires evaluation information on the implemented incident response using the evaluation unit 114 (step S112). The evaluation unit 114 outputs the acquired evaluation information to the goodness-of-fit learning unit 116, and the goodness-of-fit learning unit 116 uses the evaluation information to re-learn the goodness-of-fit calculation model 108A (step S114).

[0047] If the highest goodness of fit among the goodnesses of fit of the known incident responses does not exceed the threshold value (step S104: NO), the selector 110 notifies the incident definition notifier 118, and the incident definition notifier 118 notifies the administrator terminal device 310. This requests the administrator to define an unknown incident (step S120).

[0048] The incident definition unit 122 adds an unknown incident to the incident table by inserting a row into the incident table based on an operation of the administrator terminal device 310 (step S122).

[0049] The incident response creation unit 124 extracts work items from the work item table based on the defined unknown incident and inserts a row into the incident response table, thereby creating an incident response from the defined unknown incident (step S124).

[0050] The incident response creation unit 124 presents the created incident response to the administrator by outputting it to the administrator terminal device 310, and the administrator terminal device 310 accepts correction information for the incident response based on an operation by the administrator (step S128). The incident response correction unit 126 can correct the incident response for an unknown incident by correcting the incident response in accordance with the correction information.

[0051] The incident response creation unit 124 outputs the incident response created by the incident response creation unit 124 and the degree of suitability to the suitability learning unit 116. When the incident response is modified, the incident response creation unit 124 outputs the modified incident response and the degree of suitability to the suitability learning unit 116. The degree of suitability for the incident response may be, for example, a preset value or a value set in response to an operation of the administrator terminal device 310.

[0052] The goodness-of-fit learning unit 116 retrains the goodness-of-fit calculation model 108A using the incident response and goodness-of-fit output by the incident response creation unit 124 (step S130). As a result, the goodness-of-fit calculation model 108A learns the unknown incident, the created incident response, and the goodness-of-fit as learning data, and can operate to output the created incident response when the incident information acquisition unit 106 detects an unknown incident.

[0053] According to the incident response creation system 100 of the embodiment, incident information and facility information of the target system 200 are acquired, a degree of suitability of each of multiple incident responses for the incident information and facility information is calculated, one of the multiple incident responses is selected based on the multiple degrees of suitability, and if the highest degree of suitability of the multiple degrees of suitability does not reach a threshold, an unknown incident is defined based on the incident information, and an incident response is created based on the defined unknown incident. According to this incident response creation system 100, if the highest degree of suitability of the multiple degrees of suitability does not reach a threshold, an incident response is created based on the unknown incident, making it possible to propose an appropriate incident response when an unknown incident occurs.

[0054] Furthermore, according to the incident response creation system 100, when the highest degree of conformance among multiple degrees of conformance does not reach the threshold value, information requesting the definition of an unknown incident is notified to the administrator terminal device 310, thereby assisting the administrator in creating an incident response to an unknown incident. Furthermore, the incident response generation system 100 defines unknown incidents based on the correction information received from the administrator terminal device 310, thereby helping the administrator define unknown incidents.

[0055] Furthermore, according to the incident response generation system 100, the incident information, facility information, and multiple incident responses can be input to the fitness calculation model 108A, which has been trained using the incident information, facility information of the target system 200, the incident response, and the fitness, and the fitness for the incident response can be calculated based on the output of the fitness calculation model 108A. This incident response generation system 100 can learn unknown incidents and incident responses created for unknown incidents, and output the fitness of the incident responses created for unknown incidents.

[0056] Furthermore, the incident response generation system 100 can output information indicating the incident response selected by the selection unit 110 and train the goodness-of-fit calculation model using evaluation information based on the results of an incident response evaluation by the person who implemented the incident response. The incident response generation system 100 can feed back the evaluation of an incident response generated for an unknown incident and reflect it in the goodness-of-fit output from the goodness-of-fit calculation model 108A. This allows the incident response generation system 100 to evaluate, for example, an incident response generated for an unknown incident.

[0057] Although each embodiment and variant has been described, these are merely examples and are not intended to be limiting. For example, one aspect of the present invention may be realized by combining any of the embodiments or variants, or a part of each embodiment or a part of each variant, with one or more other embodiments or one or more other variants. [Explanation of symbols]

[0058] 100 Incident Response Creation System 102 Log Database 104 Incident Detection Unit 106 Incident Information Acquisition Department 108 Compatibility calculation unit 108A Conformance Calculation Model 110 Selection Section 112 Output section 114 Evaluation Department 116 Fitness Learning Unit 118 Incident definition notification section 120 Input Information Database 122 Incident definition section 124 Incident Response Creation Department 126 Incident Response and Remediation Department 200 target systems 300 Responder terminal device 310 Administrator terminal device

Claims

1. an incident information acquisition unit that acquires incident information indicating an incident in the target system; an equipment information acquisition unit that acquires equipment information indicating equipment included in the target system; a conformance calculation unit that calculates conformance of each of a plurality of incident responses to the incident information and the facility information; a selection unit that selects one of a plurality of incident responses based on the plurality of degrees of conformance calculated by the conformance calculation unit; and an incident definition unit that defines an unknown incident based on the incident information acquired by the incident information acquisition unit when the highest degree of conformance among the plurality of degrees of conformance calculated by the conformance calculation unit does not reach a threshold value; a creation unit that creates an incident response based on the unknown incident defined by the incident definition unit; An incident response creation system comprising:

2. 2. The incident response creation system of claim 1, further comprising an incident definition notification unit that notifies an administrator terminal device of information requesting the definition of the unknown incident if the highest degree of conformance among the plurality of degrees of conformance calculated by the conformance calculation unit does not reach a threshold value.

3. The incident response creation system according to claim 2 , wherein the incident definition unit defines the unknown incident based on correction information received from the administrator terminal device.

4. 2. The incident response creation system of claim 1, wherein the compatibility calculation unit inputs the incident information acquired by the incident information acquisition unit, the equipment information of the target system in which the incident occurred, and multiple incident responses into a compatibility calculation model trained using the incident information, the equipment information of the target system, the incident response, and the compatibility, and calculates the compatibility for the incident response based on an output of the compatibility calculation model.

5. 5. The incident response creation system of claim 4, further comprising: a suitability learning unit that learns the suitability calculation model using incident information indicating an unknown incident defined by the incident definition unit, incident response information indicating an incident response to the unknown incident created by the creation unit, and the suitability of the incident response to the unknown incident.

6. an output unit that outputs information indicating the incident response selected by the selection unit; an evaluation unit that acquires evaluation information indicating an evaluation of the incident response output by the output unit, the evaluation information is information based on a result of an evaluation of the incident response by a person who implemented the incident response; the fitness learning unit uses the evaluation information as the fitness to train the fitness calculation model; The incident response generation system according to claim 5 .

7. the evaluation unit acquires, as evaluation information, information indicating the number of times an incident response has been used for an incident; the fitness learning unit trains the fitness calculation model so as to output a higher fitness for an incident response that has been used more frequently for the incident. The incident response generation system according to claim 6 .

8. 6. The incident response creation system of claim 5, wherein the suitability learning unit trains the suitability calculation model so that, when there is a first incident response that has a high suitability for a known first incident, the suitability of the first incident response is increased for unknown incidents that are similar to the first incident.

9. the fitness learning unit trains the fitness calculation model so as to output a higher fitness for an incident response having a smaller number of work items in the incident response; The incident response generation system according to claim 5 .

10. An incident response creation system acquires incident information indicating an incident in a target system and facility information indicating a facility included in the target system; a step in which the incident response creation system calculates a degree of conformance of each of a plurality of incident responses to the incident information and the facility information; a step in which the incident response creation system selects one of a plurality of incident responses based on a plurality of degrees of conformance; a step of the incident response creation system defining an unknown incident based on the incident information when the highest degree of conformance among the plurality of degrees of conformance does not reach a threshold; generating an incident response based on the unknown incident by the incident response generation system; How to create an incident response, including:

11. The incident response creation system computer acquiring incident information indicating an incident in a target system and facility information indicating a facility included in the target system; calculating a degree of conformance of each of a plurality of incident responses to the incident information and the facility information; selecting an incident response from among a plurality of incident responses based on a plurality of degrees of fit; If the highest fitness value among the plurality of fitness values ​​does not reach a threshold, defining an unknown incident based on the incident information; generating an incident response based on the unknown incident; Execute the incident response creation program.

Images