Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine an event graph of a causal chain of events representing a situation within a network, the event graph including event text characterizing at least one event of the causal chain of events. The event graph may then be processed using a large language model that includes at least one topological context adapter that includes a graph adapter and a text adapter, including processing the event graph with the graph adapter and the event text with the text adapter. The at least one topological context adapter may be trained using existing narratives describing past situations, and/or may be trained using worklog data describing past situations and corresponding actions taken to remedy the past situations. Outputs of the graph adapter and the text adapter may be combined to generate a narrative of the situation that explains the causal chain of events and/or instructions to remedy the situation.

Abstract: Described systems and techniques determine an event graph of a causal chain of events representing a situation within a network, the event graph including event text characterizing at least one event of the causal chain of events. The event graph may then be processed using a large language model that includes at least one topological context adapter that includes a graph adapter and a text adapter, including processing the event graph with the graph adapter and the event text with the text adapter. The at least one topological context adapter may be trained using existing narratives describing past situations, and/or may be trained using worklog data describing past situations and corresponding actions taken to remedy the past situations. Outputs of the graph adapter and the text adapter may be combined to generate a narrative of the situation that explains the causal chain of events and/or instructions to remedy the situation.

Abstract: A computer program product is tangibly embodied on a non-transitory computer-readable medium and includes instructions that, when executed by at least one computing device, are configured to cause the at least one computing device to input a situation event graph and a corresponding scenario into a neural network model, where the neural network model includes a plurality of scenarios and historical ticket data, the situation event graph represents a situation, and the corresponding scenario represents a plurality of situations similar to the situation. The neural network model processes the situation event graph and the corresponding scenario to determine a priority of the situation.

Abstract: A computer program product is tangibly embodied on a non-transitory computer-readable medium and includes instructions that, when executed by at least one computing device, are configured to cause the at least one computing device to input a situation event graph, topology data associated with the situation event graph, and a knowledge graph associated with the situation event graph into a neural network model. The neural network model includes a plurality of scenarios received from a database, where the situation event graph represents a situation and each of the plurality of scenarios represents at least two similar situations. The neural network model processes the situation event graph, the topology data, and the knowledge graph to determine a similarity estimate between the situation event graph and the plurality of scenarios. The situation event graph is identified as a match to one of the plurality of scenarios based on the similarity estimate.

Abstract: A computer program product is tangibly embodied on a non-transitory computer-readable medium and includes instructions that, when executed by at least one computing device, are configured to cause the at least one computing device to input a situation event graph and a corresponding scenario into a neural network model, where the neural network model includes a plurality of scenarios, the situation event graph represents a situation, and the corresponding scenario represents a plurality of situations similar to the situation. The neural network model processes the situation event graph and the corresponding scenario to determine a causal impact of the situation.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques perform causal chain extraction for an investigated event in a system, using a neural network trained to represent a temporalsequence of events within the system. Such neural networks, by themselves, may be successful in predicting or characterizing system events, without providing useful interpretations of causation between the system events. Described techniques use the representational nature of neural networks to perform intervention testing using the neural network, distinguish confounding events, and identify a probabilistic root cause of the investigated event.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, continuously generate a knowledge graph, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: A topology-based transversal analysis service has been created that correlates topologies of different domains of a distributed application and creates cross-domain “stories” for the different types of transactions provided by the distributed application. A “story” for a transaction type associates an event(s) with a node in an execution path of the transaction type. This provides context to the event(s) with respect to the transaction type (“transaction contextualization”) and their potential business impact. The story is a journal of previously detected events and/or information based on previously detected events. The events have been detected over multiple instances of a transaction type and the journal is contextualized within an aggregate of execution paths of the multiple instances of the transaction type. The story can be considered a computed, ongoing narrative around application and infrastructure performance events, and the narrative grows as more performance-related events are detected.

Abstract: A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.