Cross-Layer Incident Investigation Using Anomaly Facts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing incident investigation systems are manually implemented and domain-based, lacking awareness of application and platform layers, leading to inaccurate responses and inefficient incident resolution.
Innovation Solution
An automated incident investigation system that performs end-to-end analysis across application, managed infrastructure, and platform layers, utilizing anomaly detection, troubleshooting, and enrichment to identify root causes and provide comprehensive summaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual incident investigation processes are used, then system complexity is reduced, but productivity and accuracy of incident resolution deteriorate
Solution Approach 1:
The investigation system is divided into distinct modules: anomaly detection module, troubleshooting module, enrichment module, and summary generation module. Each module handles a specific aspect of incident investigation, allowing the system to process complex incidents through coordinated simple functions rather than a single complex monolithic system.
Solution Approach 2:
The patent introduces an intermediary data structure called 'facts' that standardizes information between different system layers (application, managed infrastructure, platform). This facts layer acts as a mediator that enables automated investigation across domains without requiring direct complex integrations between all system components.
2Adaptability or versatility
If domain-based investigation tools are used, then ease of operation is improved, but adaptability across different system layers deteriorates
Solution Approach 1:
The investigation system is designed with universal components that can operate across multiple system layers (application, managed infrastructure, platform). The anomaly detection, troubleshooting, and enrichment functions work consistently across different domains, providing multi-functional capability while maintaining operational simplicity through standardized interfaces.
Solution Approach 2:
The patent adds a new organizational dimension by introducing structured 'facts' as a standardized representation layer. This facts dimension organizes information from multiple system layers in a uniform structure, enabling the system to handle cross-layer investigations without increasing operational complexity for users.
3Loss of time
If manual triage is performed, then device complexity is reduced, but loss of time in incident resolution increases
Solution Approach 1:
The system performs preliminary automated actions including anomaly detection, data enrichment, and root cause identification before human intervention is needed. By completing these time-consuming tasks automatically in advance, the system eliminates manual triage time while the complexity is contained within automated modules that execute predefined investigation logic.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Systems and methods are provided for automated incident investigation. Anomaly detection is used to identify anomalies in incident data (e.g., alerts, changes, metrics, logs, and/or system health), and the identified anomalies are converted into facts (or textual prompt inputs for a large language model ("LLM")). A troubleshooting or diagnostic system is run on the anomalies to provide additional facts to identify a root cause of an incident. The facts from the diagnostics, the facts from the anomaly detections are entered into a consolidated explainer that generates a summary of what happened, what is a likely cause, and what to do next to resolve the issue. In examples, anomaly enrichment data including a time correlation result, a weighted list of abnormal transaction patterns, a list of abnormal trace patterns, a list of exception patterns, a difference pattern, and/or region data are input as further facts to enhance the incident investigation process.