Alert Filtering by Service Configuration for Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
System administrators spend a significant amount of time and effort monitoring alerts and resolving incidents in computer networks, highlighting the need for improved alert presentation and filtering techniques.
Innovation Solution
The implementation of dynamic filtering based on any attribute and/or calculation, including filtering by tags, impacted services, configuration items, and properties of these items, along with an interactive filter panel that allows for real-time filtering and grouping of alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrators manually monitor and filter alerts, then comprehensive alert coverage is achieved, but time consumption and operational effort increase significantly
Solution Approach 1:
The system performs preliminary filtering and grouping of alerts based on service impact before presentation to administrators. Alerts are pre-processed to identify affected services, aggregate related alerts, and prioritize them based on service criticality, so administrators receive pre-organized alert information ready for decision-making.
Solution Approach 2:
The patent introduces an intermediary alert management system that sits between alert generation and administrator review. This intermediary automatically filters, aggregates, and prioritizes alerts based on service impact, acting as a mediator that reduces the volume of alerts requiring human attention while maintaining comprehensive monitoring coverage.
2Loss of information
If all alerts are presented to administrators, then complete visibility is achieved, but information overload and difficulty in prioritization occur
Solution Approach 1:
The patent segments alerts by affected services, creating distinct groups of alerts associated with each service. This segmentation allows administrators to view and prioritize alerts service-by-service rather than as a single undifferentiated list, making it easier to understand impact and prioritize responses.
Solution Approach 2:
The system applies different presentation qualities to different alert groups based on service criticality and alert severity. Critical service alerts are highlighted and prioritized in the presentation, while less critical alerts are grouped or summarized, providing locally optimized information density for different alert categories.
3Measurement precision
If alerts are filtered by multiple attributes, then relevant alert identification is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal filtering framework that handles multiple attributes (service impact, alert severity, time range, etc.) through a single integrated system. The same filtering infrastructure processes all attribute combinations, avoiding the need for separate filtering mechanisms for each attribute type and reducing overall system complexity.
Data Source
AI summary
In various embodiments, a process for alert filtering based on service to facilitate triage includes receiving an alert, identifying a configuration item of a computer information technology configuration management system associated with the alert, and identifying a property of the configuration item stored separately from one or more properties included in the alert. The process includes enabling filtering of the alert based on the property of the configuration item.