IT Event Outlier Detection Using Templates for Runbook Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex IT systems generate a flood of disparate event messages that overwhelm existing monitoring systems, making it difficult to effectively categorize, summarize, or utilize the higher volume of data, leading to inefficient incident resolution and increased resource investment.
Innovation Solution
Implementing outlier detection using templates to classify resolvable objects as rare, novel, or frequent types, enabling automated handling and execution of tasks through a machine learning model that traverses a fixed depth parse tree to identify matching templates and associate tasks with a runbook workflow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual techniques and pre-programmed rules are used for event processing, then systems can handle complex IT environments, but labor and computing resources are intensive and expensive
Solution Approach 1:
The system enables automated self-service through machine learning models that automatically classify events into templates and execute runbooks without human intervention. The model retrains itself using received resolvable objects, creating a self-improving system that reduces both labor and computing resource requirements while maintaining high processing accuracy.
Solution Approach 2:
Manual techniques and pre-programmed rules are replaced with a machine learning-based automated classification system. The ML model substitutes mechanical rule-based processing with intelligent pattern recognition, significantly improving resource efficiency while handling complex event types through template matching and automated runbook execution.
2Measurement precision
If monitoring systems arrayed to provide visibility into operational metrics are deployed, then event detection capability is improved, but flooding of disparate event messages occurs
Solution Approach 1:
The system merges disparate event messages into unified templates by identifying common patterns across different event types. Events with similar characteristics are consolidated into single template instances, reducing the volume of individual event messages while preserving detection precision through the template matching mechanism.
Solution Approach 2:
The template-based classification system provides universal handling for multiple event types. A single template can represent various specific events, allowing the system to process diverse event messages through a unified framework, thereby reducing overall message volume while maintaining comprehensive detection capability.
3Measurement precision
If title templates are obtained by traversing fixed depth parse tree with machine learning model, then automated classification accuracy is improved, but processing time increases due to delay period for retraining
Solution Approach 1:
The machine learning model performs retraining periodically at fixed delay intervals rather than continuously. This periodic retraining approach maintains classification accuracy by updating the model with newly received resolvable objects while avoiding the time loss associated with continuous retraining, thus balancing precision and processing speed.
Solution Approach 2:
The system prepares classification templates in advance by pre-processing event titles and organizing them into structured parse trees before actual classification occurs. This preliminary organization of data structures enables faster real-time classification while maintaining high accuracy through pre-computed template relationships.
Data Source
AI summary
A device may trigger a resolvable object that requires a resolution responsive to an event detected in a managed information technology environment and obtain a masked title from a title of the resolvable object by applying text processing rules to the title to obtain the masked title that includes at least one variable part that replaces a portion of the title. A device may obtain, using the masked title, a title template for the resolvable object using a machine learning model by traversing a fixed depth parse tree organized based on numbers of token positions in a masked title. A device may obtain, using the title template, a type for the resolvable object and responsive to determining that the resolvable object is of the frequent type and not of the rare type or of the novel type: identifying and automatically executing a runbook of tasks associated with the title template.