Alerting Engine Feature Suppression for Lower Processing Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing alerting engines face high overhead in processing pre-calculated features due to the large number of calculations required, leading to wasted effort when alerts are suppressed, as suppressing entire events or alerts without processing features still consumes resources.
Innovation Solution
Implement a system that generates features only if they are not on a suppression list, examines their severity, and applies alert suppression rules to determine which features to process, thereby reducing unnecessary calculations and storage costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the alerting engine processes all pre-calculated features to ensure no actionable alerts are missed, then the reliability of alert detection is improved, but the processing time and computational resources are excessively consumed
Solution Approach 1:
The system performs preliminary action by generating an alert suppression list before feature processing. The rule generator analyzes historical alert data and suppression patterns in advance, creating a predefined list of features that will not lead to actionable alerts. This allows the alerting engine to skip processing these features entirely, reducing processing time while maintaining reliability for important alerts.
Solution Approach 2:
The system applies partial action by selectively processing only those features that are not on the suppression list. Instead of processing all features or using a coarse-grained suppression approach, the system performs partial processing on a feature-by-feature basis, examining each feature against the suppression list to determine whether it should be processed or skipped.
2Productivity
If the system suppresses entire events to reduce processing overhead, then the processing cost is reduced, but important alerts may be missed because the same event may contribute to multiple features
Solution Approach 1:
The system segments the suppression decision at the feature level rather than at the event level. Each feature is independently evaluated against the suppression list, allowing the system to suppress individual features while still processing other features derived from the same event. This granular segmentation ensures that important alerts are not missed while still reducing processing overhead for non-actionable features.
Solution Approach 2:
The system applies local quality by making suppression decisions specific to each feature's characteristics and context. The rule generator analyzes the specific properties of each feature and its relationship to actionable alerts, applying suppression rules locally to individual features rather than uniformly to all events or features. This allows different parts of the system to have different processing behaviors based on their specific needs.
3Measurement precision
If the alerting engine processes all features including those that will be suppressed, then complete analysis is performed, but computational resources and memory are wasted on unnecessary calculations
Solution Approach 1:
The system performs preliminary action by pre-generating the alert suppression list and using it to filter features before processing. The rule generator analyzes historical data in advance to identify patterns of non-actionable alerts, creating a suppression list that guides subsequent feature processing. This preliminary preparation prevents wasteful computation of features that would not lead to actionable alerts.
Solution Approach 2:
The system extracts and removes features that are likely to result in suppressed alerts before they consume computational resources. By querying the suppression list and excluding matching features from processing, the system takes out the unnecessary computational burden while maintaining complete analysis of all potentially actionable features.
Data Source
AI summary
A system, including a computer with a processor and memory executing an application configured to perform: receiving one or more events occurring in a computer network, querying a feature suppression list to determine if to suppress generation of specific features, generating features from the received events, which are not in the feature suppression list, examining each feature to determine if to initiate an alert and setting a severity level for the alert, analyzing the alert suppression rules to determine which features serve as a basis for alerts that are acted on and which features serve as a basis for alerts that are suppressed, generating the feature suppression list, listing features that should be suppressed.