Incident Management System Investigation Sequence Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Incident management systems face inefficiencies in cause-analysis due to reliance on trial-and-error methods and lack of experience sharing among IT professionals, leading to increased time and resources spent on investigating incidents without contributing instructions.
Innovation Solution
An incident management system generates a proposed sequence of investigation instructions based on historical logs, clustering similar instructions, and computing scores to increase accuracy and usability, presenting these instructions in a GUI for immediate execution by the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If incident management systems rely on trial-and-error methods and lack experience sharing, then IT professionals spend increased time and resources on investigating incidents, but the accuracy and efficiency of cause-analysis deteriorates
Solution Approach 1:
The system performs preliminary action by automatically generating a proposed sequence of investigation instructions based on historical logs before the user begins their investigation. This pre-computed sequence, derived from clustering similar historical instructions and computing their scores, provides IT professionals with a head-start, eliminating the need to begin investigations from scratch and significantly reducing investigation time while maintaining high accuracy.
Solution Approach 2:
The system implements feedback by analyzing historical investigation logs and using that accumulated experience to generate improved investigation sequences. The system continuously learns from past investigations, clustering similar instructions and computing scores based on historical effectiveness, then feeds this knowledge back to guide current investigations through the proposed sequence, thereby improving accuracy over time.
2Adaptability or versatility
If incident management systems present comprehensive investigation instructions, then the system provides thorough cause-analysis capability, but the complexity of the system increases
Solution Approach 1:
The system applies segmentation by dividing the comprehensive set of investigation instructions into a structured sequence of individual steps. Each instruction in the proposed sequence is a discrete, actionable item that can be executed independently. This segmentation makes the complex cause-analysis capability manageable and user-friendly, allowing IT professionals to follow a clear step-by-step guide rather than overwhelming them with all possible instructions at once.
Solution Approach 2:
The system implements dynamics by generating investigation sequences that are adaptive rather than static. The proposed sequence is dynamically created based on the specific incident details and clustered from similar historical cases. The system can adjust the sequence of instructions presented to the user based on the incident characteristics, providing comprehensive cause-analysis capability tailored to each situation while maintaining manageable complexity through context-relevant filtering.
3Measurement precision
If incident management systems use historical logs to generate investigation sequences, then the accuracy of investigation instructions increases, but the computational processing required increases
Solution Approach 1:
The system performs preliminary action by pre-processing and clustering historical investigation logs into organized groups of similar instructions with computed scores. This one-time computational effort creates a reusable knowledge base that can be quickly queried during incident investigations. By doing the heavy computational lifting in advance rather than during each investigation, the system achieves high accuracy in generated sequences while minimizing real-time computational processing requirements.
Solution Approach 2:
The system applies copying by creating simplified representations of complex historical investigation patterns. Instead of processing entire historical logs each time, the system creates clustered copies of successful instruction sequences that capture the essential patterns. These copied and generalized instruction templates can be rapidly matched to current incidents, maintaining high accuracy while significantly reducing computational processing requirements compared to analyzing raw historical data from scratch.
Data Source
AI summary
An incident management system comprises a processor adapted for: receiving a plurality of logs each documenting at least one historical investigation instruction executed in the management system and each comprising a parameter range of the historical instruction and a presentation type of response data received in response to executing the historical instruction; and in each of a plurality of iterations: receiving from a GUI of the management system an incident report selected by a user from a plurality of incident reports presented therein; generating, based on the incident report and an analysis of the logs, a sequence of investigation instructions for generating part of the GUI depicting analysis data for cause-analysis of an incident documented by the incident report; and presenting the sequence of instructions in the GUI such that when the user selects one of the sequence of instructions, the selected instruction is executed by the processor.