Abstract: Techniques for selecting a runbook to as a recommendation to diagnose or remediate an event are disclosed. A system identifies an event, such as an anomaly in monitored metrics values. The system identifies runbooks associated with the event. The system analyzes the runbooks to determine which runbooks to recommend for remediating the event. The analysis includes previewing results of operations associated with steps of the runbooks to identify interesting results. The system performs a runbook operation prior to recommending the runbook for diagnosing or remediating the event. Based on the results of the operations, the system determines a relevance of a runbook to the diagnosis or remediation of the detected event. The system recommends a runbook for diagnosing or remediating the event based on the relevance of the set of results to the diagnosis or remediation of the event.

Abstract: Techniques for selecting a runbook to recommend for remediating a detected event are disclosed. When a system detects an event, the system obtains metadata associated with the event. The metadata provides information about the event and a system topology of the system in which the event occurred. The system generates a recommendation for a runbook to remediate the event based on one or both of characteristics of the event and characteristics of the topology in which the event occurred. The system compares a system topology to system topologies associated with previously-executed runbooks. The system recommends one of the previously-executed runbooks to remediate a detected event based on determining that the topology associated with the previously-executed runbook is similar to the topology of the system in which the event occurred.