Alerting Engine Suppression Lists for Lower Feature Processing Cost
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing alerting engines face high overhead in processing pre-calculated features for alerts, leading to wasted effort when many alerts are suppressed, as suppressing entire events or alerts without processing features is inefficient.
Innovation Solution
Implement a system that generates features only if they are not on a suppression list, determines alert severity, and applies suppression rules to reduce processing and storage costs by selectively generating and acting on alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all events are processed to generate features and alerts, then comprehensive monitoring coverage is achieved, but computational overhead and processing costs increase significantly
Solution Approach 1:
The system performs preliminary action by generating an alert suppression list before processing events. This list pre-identifies which alert types should be suppressed based on historical data and administrative policies. When events are processed, the system checks this pre-generated suppression list to determine whether to generate alerts, avoiding unnecessary computational overhead while maintaining comprehensive monitoring coverage for non-suppressed alert types.
2Productivity
If alerts are suppressed after full processing, then alert volume is reduced, but computational resources are wasted on processing features that lead to suppressed alerts
Solution Approach 1:
The system performs preliminary action by generating a feature suppression list before processing events. This list is created by analyzing the alert suppression list and identifying which features would lead to suppressed alerts. The feature suppression list is used during event processing to skip generation of features that would ultimately result in suppressed alerts, thereby eliminating wasted computational resources while maintaining efficient alert handling for non-suppressed alerts.
3Loss of energy
If event processing is suppressed to reduce alert volume, then computational costs decrease, but important alerts may be missed
Solution Approach 1:
The system applies segmentation by dividing the suppression mechanism into two distinct layers: event suppression and feature suppression. Event suppression skips processing of entire events that are known to lead to suppressed alerts. Feature suppression selectively skips generation of specific features that would lead to suppressed alerts while still processing other features. This segmented approach ensures that only truly unnecessary processing is skipped, maintaining alert detection accuracy while reducing computational costs.
4Reliability
If all features are generated and examined, then complete alert coverage is ensured, but processing time and memory usage increase
Solution Approach 1:
The system performs preliminary action by generating a feature suppression list before event processing. This list identifies which features should not be generated because they would lead to suppressed alerts. During event processing, the system checks this pre-generated list to determine whether to generate features, skipping those that are unnecessary. This eliminates wasted processing time and memory usage while ensuring complete alert coverage for all non-suppressed alert types.
Data Source
AI summary
A system, including a computer with a processor and memory executing an application configured to perform: receiving one or more events occurring in a computer network, querying a feature suppression list to determine if to suppress generation of specific features, generating features from the received events, which are not in the feature suppression list, examining each feature to determine if to initiate an alert and setting a severity level for the alert, analyzing the alert suppression rules to determine which features serve as a basis for alerts that are acted on and which features serve as a basis for alerts that are suppressed, generating the feature suppression list, listing features that should be suppressed.