Machine Learning Incident Priority Adjustment for Faster Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Operations computing systems struggle to efficiently triage incidents based on their urgency and severity levels, leading to inefficient handling of critical issues.
Innovation Solution
An operations computing system applies a machine learning model using natural language prompts to determine adjusted priority levels for incidents, allowing for more accurate and timely escalation of high-priority incidents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional rule-based priority assignment is used, then system simplicity is maintained, but incident triage accuracy and responsiveness to urgent issues deteriorate
Solution Approach 1:
A machine learning model is introduced as an intermediary component between incident data and priority assignment. The model receives incident data (events, logs, metrics) and outputs adjusted priority levels, bridging the gap between raw data and decision-making while improving accuracy beyond simple rule-based systems.
Solution Approach 2:
The system transitions from static rule-based priority parameters to dynamic parameters that incorporate multiple incident attributes (severity, urgency, impact, detection time). The machine learning model processes these varying parameters to generate optimized priority assignments that adapt to different incident scenarios.
2Productivity
If manual incident triage is used, then detailed human judgment is applied, but processing time and operational overhead increase
Solution Approach 1:
The system enables automated self-service incident triage where the machine learning model independently analyzes incident data and assigns priority levels without requiring manual human intervention for each incident. This automation dramatically increases processing speed while maintaining accurate priority assessment.
Solution Approach 2:
The machine learning model performs preliminary priority assessment automatically as incidents are created, determining priority levels before human operators need to review them. This preliminary action allows operators to focus only on incidents requiring human judgment rather than triaging every incident manually.
3Reliability
If basic incident tracking is implemented, then system simplicity is maintained, but the ability to effectively triage and respond to incidents of varying severity deteriorates
Solution Approach 1:
The incident management system is segmented into distinct functional components: incident detection, data collection, machine learning model processing, priority assignment, and workflow routing. This segmentation allows each component to specialize in its function, improving overall reliability while managing complexity through modular design.
Solution Approach 2:
The machine learning model serves multiple functions simultaneously: analyzing incident data, determining priority levels, and providing recommendations for incident response. This multi-functionality improves system reliability by ensuring consistent priority assignment across all incident types without requiring separate specialized systems.
Data Source
AI summary
An operations computing system receives event data for one or more events and generates, based on the event data, an incident object for an incident. The incident object includes incident data including a priority level. The operations computing system generates an incident workflow for the incident object. The operations computing system applies, using an application programming interface, a machine learning model to determine an adjusted priority level for the incident object, in which the machine learning model is configured to receive one or more valid natural language prompts related to incident priority level. The operations computing system receives the adjusted priority level for the incident object, and updates the incident object associated with the incident workflow with the adjusted priority level. The operations computing system performs one or more actions included in the incident workflow for the incident object based on the adjusted priority level for the incident workflow.