Abstract: A histogram tree data structure is initiated with a predetermined precision for sampled data objects. The data structure includes a plurality of nodes including at least one exponential node and one or more regular nodes. The data structure is populated with truncated representations of the sampled data objects, each representation is derived by applying the predetermined precision to a data object to obtain a truncated data value; and sequentially inserting components of the truncated data value into the data structure, starting at the exponential node and followed by at least some of the one or more regular nodes, wherein each node is populated with a specific component of the truncated data value. Respective statistics are computed for each populated node. A histogram algorithm is utilized to compute at least one of statistics or metrics based on the respective statistics stored in the nodes of the data structure.

Abstract: An information technology (IT) component associated with a first alert having an alert type is identified. A first list of recommended actions associated with the IT component is output. The first list includes a recommended action. A first user input of a user-selected action is received. An alert-to-component likelihood between the IT component and the alert type is decreased based on a determination that the first list does not include the user-selected action. The IT component is identified as being associated with a second alert based on the alert-to-component likelihood exceeding an alert-to-component likelihood threshold. A second list of recommended actions associated with the IT component is output. The second list does not include the recommended action and includes the user-selected action. A second user input of the user-selected action is received. A request to execute the user-selected action is transmitted.

Abstract: An outage risk detection alert is generated for one or more organizations of a plurality of organizations. Computer service incidents are monitored for the plurality of organizations to identify computer services having current computer service incidents. A count of organizations of the plurality of organizations that utilize a particular computer service and that have a current computer service incident related to the particular computer service within a plurality of time windows are aggregated to generate an aggregate count for the particular computer service for each time window of the plurality of time windows. An outage risk detection alert for the particular computer service is generated responsive to the aggregated count for a time window of the plurality of time windows surpassing a threshold level.

Abstract: Dependencies between services are determined based on the relationships between entities responsible for the services. The relationships are found based on past interactions between the entities. A relationship network graph having nodes representing entities and edges is built representing interactions between respective entities. The relationship network graph is analyzed to identify pairs of nodes having a relationship based on an evaluation between edge paths between the pairs of nodes compared to edge paths between other pairs of nodes. Associations are built between services owned by entities represented by the nodes of a pair of nodes identifying that nodes are dependent on one another.

Abstract: A learner object that incorporates indications of agreements and disagreements with determinations obtained from a clustering engine of adding incoming events to one or more events groups is generated. An event is received based on monitored conditions. A determination is made not to add the event to an events group based on a first similarity score obtained from the clustering engine between the event and the events group not exceeding a threshold value. In response to determining not to add the event to the events group, a determination to add the event to the events group is obtained based on the learner object. In response to the determination obtained based on the learner object, the event is added with to the events group. A user interface configured to visually display and obtain feedback regarding additions of events to the events groups based on determinations of the clustering engine is generated.

Abstract: An information technology (IT) component associated with a first alert having an alert type is identified. A first list of recommended actions associated with the IT component is output. The first list includes a recommended action. A first user input of a user-selected action is received. An alert-to-component likelihood between the IT component and the alert type is decreased based on a determination that the first list does not include the user-selected action. The IT component is identified as being associated with a second alert based on the alert-to-component likelihood exceeding an alert-to-component likelihood threshold. A second list of recommended actions associated with the IT component is output. The second list does not include the recommended action and includes the user-selected action. A second user input of the user-selected action is received. A request to execute the user-selected action is transmitted.

Abstract: A first numerical value is obtained based on a first data source. The first numerical value is stored in a tree structure according to a precision by storing an exponent for the first numerical value in an exponential node of the tree structure and storing respective significant figure digits of the first numerical value in respective regular nodes of the tree structure. Information is computed for nodes in the tree structure. The information includes one or more of statistics, metrics, or histogram information. The computed information is employed to respond to a query related to the data source.

Abstract: Pausing alert notifications includes triggering an alert responsive to an event in a managed environment. A normalized title is obtained from a title of the alert. Using the normalized title, it is determined whether the alert is of a likely transient type, where the alert is of the likely transient type when it is predicted to resolve without human intervention. A transmission of notifications for the alert during a pause period is withheld responsive to determining that the alert is the likely transient type. A notification for the alert is transmitted to a responder responsive to determining that the alert is unresolved after the pause period.

Abstract: Embodiments are directed to managing operations over a network. An event associated with network operations may be provided. A hash function may generate key values that correspond to words included in message information associated with the event. A message vector may be generated based on the key values such that each component in the message vector that corresponds to a key value is set to one. Group vectors may be determined such that each group vector is associated with an event group. Similarity scores may be generated for the group vectors based on the message vector and the group vectors such that each group vector corresponds to a separate similarity score. If the similarity scores exceed a threshold, the event may be associated with event groups associated with a group vector that correspond similarity score that exceeds the threshold.

Abstract: A method for event processing includes accepting for processing, as accepted events and according to a target rate limit, at least a subset of received events; associating respective ingested timestamps with the accepted events; associating respective processing completion timestamps with processed events of the accepted events; determining an average measured lag time using at least a subset of the respective processing completion timestamps and corresponding respective ingested timestamps; obtaining a throttled rate limit using a proportional-integral-derivative (PID) controller; and accepting subsequent events according to the throttled rate limit. The PID controller can be configured to use, as an input, an error value that is a difference between a target lag time and the average measured lag time. An integral part of the PID controller can be set to zero responsive to an accumulated average lag time being less than the target lag time.

Abstract: Embodiments are directed to managing operations over a network. An event associated with network operations may be provided. A hash function may generate key values that correspond to words included in message information associated with the event. A message vector may be generated based on the key values such that each component in the message vector that corresponds to a key value is set to one. Group vectors may be determined such that each group vector is associated with an event group. Similarity scores may be generated for the group vectors based on the message vector and the group vectors such that each group vector corresponds to a separate similarity score. If the similarity scores exceed a threshold, the event may be associated with event groups associated with a group vector that correspond similarity score that exceeds the threshold.

Abstract: Data objects are sampled from data sources and stored in a tree data structure that is employed to compute histogram information. Each node in the tree includes sufficient statistics and a particular value corresponding to one or more sampled data objects. The nodes of the tree can be two or more types, such as exponential nodes and regular nodes. Also, each histogram tree may be precalculated to start with an empty exponential node, and a defined number of regular nested nodes that correlate to a precision value for the histogram, i.e., a number of significant figures for sampled data values that can be stored in the tree.

Abstract: Embodiments are directed to managing operations. If Operations events are provided, event clusters may be associated with one or more Operations events, such that the Operations events may be associated with the event clusters based on characteristics of the Operations events. Metrics including resolution metrics, root cause analysis, notes, and other remediation information may be associated with the event clusters. Then a modeling engine may be employed to train models based on the Operations events, the event clusters, and the resolution metrics, such that the trained model may be trained to correlate and predict the resolution metrics from real-time Operations events. If real-time Operations events may be provided, the trained models may be employed to predict the resolution metrics that are associated with the real-time Operations events. If model performance degrades beyond accuracy requirements, new observations may be added to the training set and the model re-trained.

Abstract: Embodiments are directed towards generating and managing schedules. In at least one of the various embodiments, these schedules may be configured to schedule team members, rotating which team member is active (“on-call”). In at least one of the various embodiments, these may be employed to determine which resource is responsible to respond and/or resolve incidents that may be reported and/or detected. In at least one of the various embodiments, if a team member is determined to be the on-call or responsible team member, the notification engine may determine the methods for notify the responsible of the incidents. Schedules previews may be updated in real-time as the schedule is edited.

Abstract: Embodiments are directed to managing operations over a network. An event associated with network operations may be provided. A hash function may generate key values that correspond to words included in message information associated with the event. A message vector may be generated based on the key values such that each component in the message vector that corresponds to a key value is set to one. Group vectors may be determined such that each group vector is associated with an event group. Similarity scores may be generated for the group vectors based on the message vector and the group vectors such that each group vector corresponds to a separate similarity score. If the similarity scores exceed a threshold, the event may be associated with event groups associated with a group vector that correspond similarity score that exceeds the threshold.

Abstract: Embodiments are directed towards to managing operations for an organization. An operation engine may be employed to provide operations metrics based on events and resolution actions associated with an incident. Update information may be provided to console modules included in operations command consoles (OCCs) each console module may include module views. The console modules may be employed to provide data objects to the module views. The module views may be employed to provide different visualizations of the incident based on a role that may be associated with the console modules. An OCC may be employed to provide other resolution actions to the operations engine and then that operations engine may provide additional update information to the console modules based on the other resolution actions.

Abstract: Embodiments are directed towards embodiments for monitoring or predicting user health with respect their use of connected computers, such as, mobile phones, tablets, or the like. Activities associated with a user and a computing device may be monitored to determine activity events. One or more sub-scores may be provided in real time based on metrics provided as input to sub-score models such that the metrics are associated with the activity events. A health score associated with a probability of an occurrence of adverse user outcomes may be provided based on a health model that uses the sub-scores. An analysis engine may compare the health score to other health scores to predict in real time the adverse outcomes. The analysis engine may recommend one or more actions to decrease the probability of the occurrence of the adverse outcomes based on the result.

Abstract: Embodiments are directed towards an operations maturity model. An operations management system may associate events with one or more organizations. Event metric information may be provided based on the events for one or more sub-scores. The sub-scores may be scaled to fit within a defined range. An operations maturity score may be provided for the organizations that may be based on the scaled sub-scores. One or more recommendations may be provided to increase the operations maturity score for the organizations based on operations maturity scores that correspond to the one or more organizations. Providing the recommendations, includes providing a correlation of operations practices and the sub-scores and providing configuration recommendations based on the operations practices that are correlated with above average sub-scores.

Abstract: Embodiments are directed towards generating and managing schedules. In at least one of the various embodiments, these schedules may be configured to schedule team members, rotating which team member is active (“on-call”). In at least one of the various embodiments, these may be employed to determine which resource is responsible to respond and/or resolve incidents that may be reported and/or detected. In at least one of the various embodiments, if a team member is determined to be the on-call or responsible team member, the notification engine may determine the methods for notify the responsible of the incidents. Schedules previews may be updated in real-time as the schedule is edited.

Abstract: Embodiments are directed to managing operations. If Operations events are provided, event clusters may be associated with one or more Operations events, such that the Operations events may be associated with the event clusters based on characteristics of the Operations events. Metrics including resolution metrics, root cause analysis, notes, and other remediation information may be associated with the event clusters. Then a modeling engine may be employed to train models based on the Operations events, the event clusters, and the resolution metrics, such that the trained model may be trained to correlate and predict the resolution metrics from real-time Operations events. If real-time Operations events may be provided, the trained models may be employed to predict the resolution metrics that are associated with the real-time Operations events. If model performance degrades beyond accuracy requirements, new observations may be added to the training set and the model re-trained.