Abstract: A method including receiving events from different data sources for a service automatically executing in an enterprise system. A first event is enriched by providing the first event with first metadata that associates the first event with a first application used by the service. The first event is assigned to a time slice associated with the first application. A second event is enriched in a similar manner. A correlation graph of nodes and edges is built using the enriched events, with nodes representing the events and edges indicating relationships between the edges. A third event indicating a fault in the first application associated with the first node is received. The source of the error for the third event is identified using the second updated correlation graph and the time slice. The source of error is then mitigated.

Abstract: A method including receiving events from different data sources for a service automatically executing in an enterprise system. A first event is enriched by providing the first event with first metadata that associates the first event with a first application used by the service. The first event is assigned to a time slice associated with the first application. A second event is enriched in a similar manner. A correlation graph of nodes and edges is built using the enriched events, with nodes representing the events and edges indicating relationships between the edges. A third event indicating a fault in the first application associated with the first node is received. The source of the error for the third event is identified using the second updated correlation graph and the time slice. The source of error is then mitigated.

Abstract: A method for metrics-based anomaly detection involves receiving an anomaly analysis request for an asset and obtaining metrics associated with the asset. Each of the metrics includes time series data. The method further involves detecting that one of the metrics is a counter. The detection involves seasonally differencing the metric, obtaining a regression line by performing a linear regression on the metric, and determining that an angle of the regression line exceeds a predetermined threshold angle. The method also involves training models for the metrics, the training including training a counter-specific model for the metric that is a counter. The method further involves determining, using the models after the training, at least one metric that is anomalous.

Abstract: A system including a data repository storing metrics describing operational behavior of software programs executing in an enterprise system. The system also includes an application programming interface (API) gateway configured to receive the metrics. The system also includes an ingestion layer configured to ingest the metrics to form the ingested metrics. The system also includes a tumbling window processor configured to process the ingested metrics and the events into heat maps, sort the heat maps into the time slices, and populate the time slices with the ingested metrics.

Abstract: A method may include receiving an event from an event source. The event may correspond to event data. The event source may be a container executing an image. The image may correspond to image metadata including attributes describing the image. The method may further include combining the event data with the image metadata to obtain enriched data, detecting, using the enriched data, a deviation from a policy, and in response to detecting the deviation from the policy, performing an action to enforce the policy.

Abstract: A method includes receiving first metrics describing first behaviors of applications having a fault, and second metrics describing second behaviors of an enterprise system in which the applications are executing. The first and second metrics are ingested. Ingesting includes assigning a first cardinality score to first metrics related to the fault. Ingesting also includes assigning a second, lower cardinality score to second metrics that are unrelated to the fault. Tumbling window processing is performed on the ingested metrics by sorting the first metrics and the second metrics into time slices. Each of the time slices includes a corresponding data structure for storing the data in the different time periods. Tumbling window processing is also performed on the ingested metrics by storing more data in the time slices for the first metrics having the first cardinality score relative to the second metrics having the second cardinality score.

Abstract: A method includes receiving first metrics describing first behaviors of applications having a fault, and second metrics describing second behaviors of an enterprise system in which the applications are executing. The first and second metrics are ingested. Ingesting includes assigning a first cardinality score to first metrics related to the fault. Ingesting also includes assigning a second, lower cardinality score to second metrics that are unrelated to the fault. Tumbling window processing is performed on the ingested metrics by sorting the first metrics and the second metrics into time slices. Each of the time slices includes a corresponding data structure for storing the data in the different time periods. Tumbling window processing is also performed on the ingested metrics by storing more data in the time slices for the first metrics having the first cardinality score relative to the second metrics having the second cardinality score.

Abstract: A system including a data repository storing metrics describing operational behavior of software programs executing in an enterprise system. The system also includes an application programming interface (API) gateway configured to receive the metrics. The system also includes an ingestion layer configured to ingest the metrics to form the ingested metrics. The system also includes a tumbling window processor configured to process the ingested metrics and the events into heat maps, sort the heat maps into the time slices, and populate the time slices with the ingested metrics.

Abstract: A method including receiving events from different data sources for a service automatically executing in an enterprise system. A first event is enriched by providing the first event with first metadata that associates the first event with a first application used by the service. The first event is assigned to a time slice associated with the first application. A second event is enriched in a similar manner. A correlation graph of nodes and edges is built using the enriched events, with nodes representing the events and edges indicating relationships between the edges. A third event indicating a fault in the first application associated with the first node is received. The source of the error for the third event is identified using the second updated correlation graph and the time slice. The source of error is then mitigated.

Abstract: A method including receiving events from different data sources for a service automatically executing in an enterprise system. A first event is enriched by providing the first event with first metadata that associates the first event with a first application used by the service. The first event is assigned to a time slice associated with the first application. A second event is enriched in a similar manner. A correlation graph of nodes and edges is built using the enriched events, with nodes representing the events and edges indicating relationships between the edges. A third event indicating a fault in the first application associated with the first node is received. The source of the error for the third event is identified using the second updated correlation graph and the time slice. The source of error is then mitigated.

Abstract: A method may include receiving an event from an event source. The event may correspond to event data. The event source may be a container executing an image. The image may correspond to image metadata including attributes describing the image. The method may further include combining the event data with the image metadata to obtain enriched data, detecting, using the enriched data, a deviation from a policy, and in response to detecting the deviation from the policy, performing an action to enforce the policy.