Incident Prediction Model for IT Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Incident handling in IT environments faces challenges in correlating user incidents with performance metrics from event monitoring, leading to difficulties in timely and effective incident resolution.
Innovation Solution
A computer program product that receives resolved incident tickets and events from a technology landscape, generates incident clusters, identifies correlated events, and uses these to train a machine learning model for predicting incidents, potential causes, and resolutions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If incident handling and event monitoring are operated independently, then each system can function with simple architecture, but the ability to correlate incidents with events is poor
Solution Approach 1:
The patent merges incident handling and event monitoring into a unified system that processes both incident data and event data together. The system correlates incidents with events by analyzing their temporal and causal relationships, enabling incident agents to see connections between user-reported incidents and backend events that would otherwise remain hidden in separate systems.
Solution Approach 2:
The unified system performs multiple functions: it handles incident reporting, monitors events, correlates the two data streams, and provides actionable insights. This multi-functional approach allows a single system to serve both incident management and event monitoring purposes while enabling cross-correlation analysis.
2Reliability
If all incidents are investigated in detail, then complete incident resolution is achieved, but the time and resources required increase significantly
Solution Approach 1:
The system performs preliminary correlation analysis between incidents and events automatically, identifying likely causal relationships before incident agents begin their investigation. By pre-processing the data and highlighting probable connections, the system reduces the initial triage time and guides agents toward the most relevant incidents requiring detailed investigation.
Solution Approach 2:
The system automatically correlates incidents with events and generates insights without requiring manual analysis of every incident. The automated correlation engine processes incident and event data streams, identifying patterns and relationships that would be difficult for agents to detect manually, thereby reducing the time and effort required for complete incident resolution.
3Loss of information
If event monitoring covers all IT resources, then comprehensive system visibility is achieved, but the difficulty of determining event-incident relationships increases
Solution Approach 1:
The system introduces an intermediary correlation layer that sits between event monitoring and incident handling. This intermediary component automatically analyzes the relationships between events and incidents, using temporal analysis, causal reasoning, and pattern recognition to bridge the gap between backend events and user-reported incidents, making correlations detectable despite the large volume of data.
Data Source
AI summary
A plurality of resolved incident tickets of a technology landscape may be received from an incident handling system. A plurality of events may be received from a metric monitoring system monitoring the technology landscape. An incident cluster having related incidents may be generated from the plurality of resolved incident tickets, and a correlated event of the plurality of events may be identified for the incident cluster. The correlated event may be stored with an incident resolution obtained from the incident cluster, to obtain labeled training data. A machine learning (ML) model may be trained with the labeled training data to obtain an incident prediction model. A new event may be processed with the incident prediction model to provide a predicted incident and a predicted resolution.