Context-Sensitive Interface Profiles for IT Incident Response

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current data intake and query systems face challenges in efficiently analyzing and searching massive quantities of diverse machine data from various sources, lacking user-friendly tools for visual identification of data subsets and requiring pre-processing that discards significant amounts of raw data, limiting flexibility and insight derivation.

Innovation Solution

A data intake and query system with a flexible schema that allows late-binding extraction rules, enabling the storage and analysis of raw machine data, and utilizing a metadata catalog for field extraction and annotation, facilitating context-sensitive user interfaces for incident response in IT environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If pre-processing is applied to reduce data volume, then data retrieval efficiency is improved, but data flexibility and insight derivation are worsened due to discarding raw data

Engineering Contradiction:

Improvedata retrieval efficiencyVSAvoiddata flexibility

Core Design Contradiction:

SpeedVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary indexing and metadata extraction on raw data without discarding it, enabling efficient future retrieval while preserving full data flexibility. The indexing process creates searchable structures in advance, and the metadata catalog stores extraction rules and annotations that can be applied flexibly at different stages.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system changes the parameter of data processing from aggressive pre-filtering to gentle indexing, transforming how data is prepared for retrieval. By using late-binding extraction rules that can be applied at search time rather than ingest time, the system maintains data flexibility while still enabling efficient queries through the metadata catalog.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If massive quantities of raw data are stored for later analysis, then data flexibility is improved, but data analysis and search efficiency are worsened

Engineering Contradiction:

Improvedata flexibilityVSAvoiddata analysis efficiency

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The system segments data processing into distinct phases: raw data ingestion, metadata extraction and cataloging, and search-time analysis. This segmentation allows raw data to be stored flexibly while the metadata catalog provides structured indexes that enable efficient analysis without requiring pre-processing of the entire dataset.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The metadata catalog acts as an intermediary between raw data storage and data analysis operations. It stores extraction rules, field definitions, and annotations that bridge the gap between unstructured raw data and structured query requirements, enabling efficient analysis without compromising data flexibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Difficulty of detecting and measuring

If tools are provided for searching data systems separately, then data retrieval capability is improved, but user-friendly visual identification of data subsets is worsened

Engineering Contradiction:

Improvedata search capabilityVSAvoidvisual identification ease

Core Design Contradiction:

Difficulty of detecting and measuringVSEase of operation

Solution Approach 1:

The system replaces mechanical search tools with a context-sensitive user interface that dynamically adapts to the user's needs and the data being analyzed. The interface uses the metadata catalog to provide intelligent suggestions, visualizations, and navigation aids that make data subset identification intuitive rather than requiring manual search tool operation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11880558B1Interface layout profiles including interface actions in an information technology and security operations application

Publication Date: 2024.01.23 CISCO TECHNOLOGY INC

AI summary

An information technology (IT) and security operations application is described that stores data reflecting customizations that users make to GUIs displaying information about various types of incidents, and further uses such data to generate “popular” interface profiles indicating popular GUI modifications. The analysis of the GUI customizations data is performed using data associated with multiple tenants of the IT and security operations application to develop profiles that may represent a general consensus on a collection and arrangement of interface elements that enable analysts to efficiently respond to certain types of incidents. Users of the IT and security operations application can then optionally apply these popular interface profiles to various GUIs during their use of the application. Among other benefits, the ability to generate and provide popular interface profiles can help analysts and other users more efficiently investigate and respond to a wide variety of incidents within IT environments, thereby improving the operation and security of those environments.