Abstract: A system and method for detecting similar incident records for initiating remediation actions in a computing environment is provided. The method includes: receiving a plurality of incident records, each incident record generated based on extracted values from a plurality of event records; generating an indexed incident record based on a plurality of predetermined categorical attributes; vectorizing a string of categorical attributes to generate a vectorized indexed incident record; storing the vectorized indexed incident record in a vector database; vectorizing a new incident record; querying the vector database based on the vectorized new incident record to detect a similar vector; and generating a similar incident record based on the detected similar vector.

Abstract: A system and method for reducing data record processing in incident report generation is provided. The method includes: accessing a plurality of event records, each event record generated based on an event in a computing environment; parsing each event record based on a predetermined data field; extracting from each predetermined data field a data value; correlating a group of event records of the plurality of event records based on at least an extracted data value; generating an incident data record based on the extracted data values of the correlated group of event records; generating a prompt based on the incident data record; and generating an incident report by configuring a large language model (LLM) to execute the generated prompt.

Abstract: A system and method for root cause analysis in incident processing, including root cause change detection, is presented. The method includes processing a plurality of event records, including a plurality of alert records and a plurality of change records, each event record generated based on an event in a computing environment; parsing each alert record based on a predetermined data field; extracting from each predetermined data field a data value; correlating a group of alert records of the plurality of alert records based on at least an extracted data value; generating an incident data record based on the extracted data values of the correlated group of alert records; detecting a change record of the plurality of change records related to the incident data record; determining that the change record is a root cause change of the incident data record; and initiating a mitigation action based on the root cause change.