Abstract: A method, computer program product, and computer system for prioritization of data collection and analysis for incident detection. Data points within a plurality of monitor data corresponding to effects of incidents may be identified by a computing device. The plurality of monitor data may be converted to a set of time series extracted from the plurality of monitor data. The set of time series may be aligned and summarized. A causal relationship graph may be constructed between the set of time series extracted from the plurality of monitor data. Features may be prioritized by likelihood of importance in incident analysis based upon, at least in part, the causal relationship graph.

Abstract: A method, apparatus, system, and computer program product for facilitating evidence collection. A set of evidence requirements is identified by computer system in which the set of evidence requirements is for a control that manages a set of resources in the computer system to enforce a policy in the computer system. Labels are associated by the computer system with historical evidence for the set of requirements. The historical evidence comprises prior evidence collected for compliance with the set of evidence requirements for the control and was accepted to meet the set of evidence requirements for the control. The historical evidence with the labels form labeled historical evidence. Rules for mining evidence for the set of evidence requirements for the control using the labeled historical evidence are learned by a machine learning model in the computer system.

Abstract: A method, apparatus, system, and computer program product for facilitating evidence collection. A set of evidence requirements is identified by computer system in which the set of evidence requirements is for a control that manages a set of resources in the computer system to enforce a policy in the computer system. Labels are associated by the computer system with historical evidence for the set of requirements. The historical evidence comprises prior evidence collected for compliance with the set of evidence requirements for the control and was accepted to meet the set of evidence requirements for the control. The historical evidence with the labels form labeled historical evidence. Rules for mining evidence for the set of evidence requirements for the control using the labeled historical evidence are learned by a machine learning model in the computer system.

Abstract: A method, computer program product, and computer system for prioritization of data collection and analysis for incident detection. Data points within a plurality of monitor data corresponding to effects of incidents may be identified by a computing device. The plurality of monitor data may be converted to a set of time series extracted from the plurality of monitor data. The set of time series may be aligned and summarized. A causal relationship graph may be constructed between the set of time series extracted from the plurality of monitor data. Features may be prioritized by likelihood of importance in incident analysis based upon, at least in part, the causal relationship graph.