Abstract: A system and method for detecting similar incident records for initiating remediation actions in a computing environment is presented. The method includes: accessing a plurality of incident records, each incident record generated based on extracted values from a plurality of event records; generating, for each incident record of the plurality of incident records, an indexed incident record based on a plurality of predetermined categorical attributes; generating a vectorized indexed incident record for each of the incident records; storing the vectorized indexed incident record for each of the incident records in a vector database; vectorizing a new incident record; querying the vector database based on the vectorized new incident record to detect a similar vector; and generating a similar incident record based on the detected similar vector.

Abstract: A system and method for evicting a resource from a unified network topology (UNT) of a computing environment, is disclosed. The method includes: generating a representation of a UNT for a network topology of a computing environment, the representation based on a unified data schema, wherein the unified data schema is mapped to a plurality of data schemas, each corresponding to a unique data source; receiving an event record at a first time, the event record including a resource identifier; updating in the UNT a representation corresponding to the resource based on extracted data from the event record at the first time; determining that a time period has lapsed from the first time which is greater than a threshold; detecting that a number of event records which include the resource identifier is less than a threshold value; and removing the representation of the resource from the unified network topology.

Abstract: A system and method for detecting similar incident records for initiating remediation actions in a computing environment is provided. The method includes: receiving a plurality of incident records, each incident record generated based on extracted values from a plurality of event records; generating an indexed incident record based on a plurality of predetermined categorical attributes; vectorizing a string of categorical attributes to generate a vectorized indexed incident record; storing the vectorized indexed incident record in a vector database; vectorizing a new incident record; querying the vector database based on the vectorized new incident record to detect a similar vector; and generating a similar incident record based on the detected similar vector.

Abstract: A system and method for updating a unified network topology for a computing environment is presented. The method includes: generating a representation of a unified network topology for a network topology of a computing environment, the representation based on a unified data schema, wherein the unified data schema is mapped to a plurality of data schemas, each data schema corresponding to a unique data source; receiving an event record from a first data source; extracting data from the event record, the extracted data indicating a change in the network topology; and updating the representation of the unified network topology based on the extracted data from the event record.

Abstract: A system and method for evicting a resource from a unified network topology (UNT) of a computing environment, is disclosed. The method includes: generating a representation of a UNT for a network topology of a computing environment, the representation based on a unified data schema, wherein the unified data schema is mapped to a plurality of data schemas, each corresponding to a unique data source; receiving an event record at a first time, the event record including a resource identifier; updating in the UNT a representation corresponding to the resource based on extracted data from the event record at the first time; determining that a time period has lapsed from the first time which is greater than a threshold; detecting that a number of event records which include the resource identifier is less than a threshold value; and removing the representation of the resource from the unified network topology.

Abstract: A system and method for incident detection based on a unified network topology of a computing environment is presented. The method includes: generating a representation of a unified network topology for a network topology of a computing environment, the representation based on a unified data schema, wherein the unified data schema is mapped to a plurality of data schemas, each data schema corresponding to a unique data source; receiving an event record respective of a first resource, the first resource represented in the unified network topology; determining a baseline behavior of the first resource based on the unified network topology; generating a predicted incident based on the baseline behavior and the received event record; and initiating a remediation action based on the predicted incident.

Abstract: A system and method for generating a unified network topology for a computing environment is presented. The method includes: receiving a plurality of event records, each event record generated based on an event in the computing environment; extracting from each event record of the plurality of event records network topology information; detecting in the extracted network topology information a parent resource and a child resource; generating a representation of the parent resource in a unified network topology; generating a representation of the child resource in the unified network topology; and connecting the representation of the parent resource to the representation of the child resource, wherein the connection represents the extracted topology information.

Abstract: A system and method for initiating remediation actions in a computing environment based on similar incident detection is presented. The method includes: generating a first incident record, based on a correlated plurality of event records, each event record indicating an event in a computing environment; generating a first vector based on the first incident record; detecting a similar incident record based on the first vector and a corresponding vector of the similar incident record; detecting a remediation action associated with the similar incident record, the remediation action previously executed in the computing environment; generating an adapted remediation action based on data extracted from the first incident record; and initiating the adapted remediation action in the computing environment.

Abstract: A system and method for detecting similar incident records for initiating remediation actions in a computing environment is provided. The method includes: receiving a plurality of incident records, each incident record generated based on extracted values from a plurality of event records; generating an indexed incident record based on a plurality of predetermined categorical attributes; vectorizing a string of categorical attributes to generate a vectorized indexed incident record; storing the vectorized indexed incident record in a vector database; vectorizing a new incident record; querying the vector database based on the vectorized new incident record to detect a similar vector; and generating a similar incident record based on the detected similar vector.

Abstract: A system and method for reducing data record processing in incident report generation is provided. The method includes: accessing a plurality of event records, each event record generated based on an event in a computing environment; parsing each event record based on a predetermined data field; extracting from each predetermined data field a data value; correlating a group of event records of the plurality of event records based on at least an extracted data value; generating an incident data record based on the extracted data values of the correlated group of event records; generating a prompt based on the incident data record; and generating an incident report by configuring a large language model (LLM) to execute the generated prompt.

Abstract: A system and method for root cause analysis in incident processing, including root cause change detection, is presented. The method includes processing a plurality of event records, including a plurality of alert records and a plurality of change records, each event record generated based on an event in a computing environment; parsing each alert record based on a predetermined data field; extracting from each predetermined data field a data value; correlating a group of alert records of the plurality of alert records based on at least an extracted data value; generating an incident data record based on the extracted data values of the correlated group of alert records; detecting a change record of the plurality of change records related to the incident data record; determining that the change record is a root cause change of the incident data record; and initiating a mitigation action based on the root cause change.