Abstract: Techniques for recommending runbook operations during a runbook generation process are disclosed. The system recommends operations for including in the runbook based on user activity. Generating operations of a runbook based on user activity generates a runbook that captures a user's behavior. The recommended operations may be different than any operations performed by the user. The recommended operations may be based in part on data sets accessed by the user frequently, periodically, or continuously.

Abstract: Techniques for recommending runbook operations during a runbook generation process are disclosed. A system recommends operations for including in the runbook based on attributes of a detected event. The system presents event attributes associated with the detected event to a user in a runbook generation interface. When the user selects an event attribute, the system presents a set of candidate runbook operations associated with the event attribute. Based on user selections of runbook operations to include in a runbook, the system generates and stores a template of the runbook in which the attribute values associated with the detected event are omitted. Upon execution of the runbook at a future time, the system, or a user, may populate the event attributes in the runbook with values that correspond to the future event of the same event type.

Abstract: Techniques for generating supplemental information based on runbook operation results are disclosed. A system generates and displays supplemental information for a runbook execution interface based on one of a system component associated with an executable operation of a runbook, and a set of runbook operation results corresponding to the executable operation. The system receives a user input to execute an operation defined by a runbook presented to remediate an event. The system generates supplemental information for the runbook execution interface based on the results of the operation executed by the user. The system identifies characteristics associated with the runbook operation results and identifies sources for additional information. Source may include performance data from the same component over a different period of time, performance data of a similar component, and performance data of topologically-connected components.

Abstract: Techniques for suppressing notifications are disclosed. An incident may repeatedly flap between various resolved and unresolved states. Furthermore, other incident attributes may flap between various states such as, for example, varying levels of incident severity. Each change in state results in the transmission of a notification. In order to reduce the number of notifications, the system estimates a flapping window for the incident based on the flapping behavior of prior incidents. The system computes a notification suppression window based at least in part on the estimated flapping window. The system suppresses notifications corresponding to changes in incident state that are detected during the notification suppression window. The notification suppression window may be extended in response to extending the estimated flapping window.

Abstract: Techniques for suppressing notifications are disclosed. An incident may repeatedly flap between various resolved and unresolved states. Furthermore, other incident attributes may flap between various states such as, for example, varying levels of incident severity. Each change in state results in the transmission of a notification. In order to reduce the number of notifications, the system estimates a flapping window for the incident based on the flapping behavior of prior incidents. The system computes a notification suppression window based at least in part on the estimated flapping window. The system suppresses notifications corresponding to changes in incident state that are detected during the notification suppression window. The notification suppression window may be extended in response to extending the estimated flapping window.

Abstract: Techniques for recommending runbook operations during a runbook generation process are disclosed. The system recommends operations for including in the runbook based on user activity. Generating operations of a runbook based on user activity generates a runbook that captures a user's behavior. The recommended operations may be different than any operations performed by the user. The recommended operations may be based in part on data sets accessed by the user frequently, periodically, or continuously.

Abstract: Techniques for selecting a runbook to as a recommendation to diagnose or remediate an event are disclosed. A system identifies an event, such as an anomaly in monitored metrics values. The system identifies runbooks associated with the event. The system analyzes the runbooks to determine which runbooks to recommend for remediating the event. The analysis includes previewing results of operations associated with steps of the runbooks to identify interesting results. The system performs a runbook operation prior to recommending the runbook for diagnosing or remediating the event. Based on the results of the operations, the system determines a relevance of a runbook to the diagnosis or remediation of the detected event. The system recommends a runbook for diagnosing or remediating the event based on the relevance of the set of results to the diagnosis or remediation of the event.

Abstract: Techniques for generating supplemental information based on runbook operation results are disclosed. A system generates and displays supplemental information for a runbook execution interface based on one of a system component associated with an executable operation of a runbook, and a set of runbook operation results corresponding to the executable operation. The system receives a user input to execute an operation defined by a runbook presented to remediate an event. The system generates supplemental information for the runbook execution interface based on the results of the operation executed by the user. The system identifies characteristics associated with the runbook operation results and identifies sources for additional information. Source may include performance data from the same component over a different period of time, performance data of a similar component, and performance data of topologically-connected components.

Abstract: Techniques for collaboratively executing runbook sessions are disclosed. A system provides for collaborative completion of runbook operations by delegating runbook operations or by transferring ownership of a runbook from one user to another. A system identifies a first set of runbook operations capable of being completed by a first user. The system identifies a second set of runbook operations that are not capable of being completed by the first user. The system identifies a second user capable of completing the second set of runbook operations. Upon completion of the first set of runbook operations by the first user, the system determines whether to delegate the second set of runbook operations to the second user or to transfer ownership of the runbook session to the second user. The system determines that the runbook session is completed based on the combined results collaboratively generated by the initial user and the alternate user.

Abstract: Techniques for recommending runbook operations during a runbook generation process are disclosed. A system recommends operations for including in the runbook based on attributes of a detected event. The system presents event attributes associated with the detected event to a user in a runbook generation interface. When the user selects an event attribute, the system presents a set of candidate runbook operations associated with the event attribute. Based on user selections of runbook operations to include in a runbook, the system generates and stores a template of the runbook in which the attribute values associated with the detected event are omitted. Upon execution of the runbook at a future time, the system, or a user, may populate the event attributes in the runbook with values that correspond to the future event of the same event type.

Abstract: Techniques for selecting a runbook to recommend for remediating a detected event are disclosed. When a system detects an event, the system obtains metadata associated with the event. The metadata provides information about the event and a system topology of the system in which the event occurred. The system generates a recommendation for a runbook to remediate the event based on one or both of characteristics of the event and characteristics of the topology in which the event occurred. The system compares a system topology to system topologies associated with previously-executed runbooks. The system recommends one of the previously-executed runbooks to remediate a detected event based on determining that the topology associated with the previously-executed runbook is similar to the topology of the system in which the event occurred.