Abstract: Methods, systems, and computer programs are presented for providing contextual suggestions and automated responses to users managing incidents within production or security environments. The system utilizes a combination of user-provided data and contextual analysis to proactively offer solutions and insights without requiring explicit queries from the user. The system integrates out-of-the-box insights, natural language interactions, and remediation flows into a cohesive user experience, incorporating playbooks enhanced by automation while leveraging user data and interaction history to tailor suggestions. The system includes a predictive analysis mechanism that runs analyses on relevant data sources, identifying unusual results and generating potential queries. A large language model (LLM) is integrated for generating questions and analyses, with a ranking system prioritizing insights based on machine learning models.

Abstract: Techniques are presented for recommending queries to search log information. The system provides useful insights and recommendations based on user needs and queries by utilizing the user context, with information about the user activities (e.g., recent alerts) and the user configuration in the system (e.g., applications configured by the user), to provide recommendations. There may not be enough context for a new user to provide good recommendations, so the system determines the context based on the activities of other users, such as more experienced users or users investigating the same type of problem. Based on the context, the user recommends natural language queries (NLQ) or system queries to accelerate the search process and assist the user during an investigation. Further, NLQs may be converted to complex search queries that use the search query language, and the NLQs may also be used as part of the context for the subsequent recommendations.

Abstract: Methods, systems, and computer programs are presented for problem detection based on deviations from the forecasted behavior of a metric. One method includes an operation for selecting a machine learning (ML) model for predicting future values of a time series for a metric. Further, the method includes forecasting, using the ML model, values of the metric for a forecast period. Afterwards, actual values of the metric are collected during the forecast period, and the actual values are compared to the forecasted values. The method further includes operations for determining an anomaly in a behavior of the metric based on the comparison, and causing presentation in a computer user interface (UI) of the anomaly.