Abstract: An example embodiment includes determining, from a target set of incident reports, a set of putative steps; determining a set of playbook steps by identifying a set of clusters within the set of putative steps, wherein each playbook step of the set of playbook steps corresponds to a respective cluster within the identified set of clusters, and wherein each cluster within the identified set of clusters contains at least one putative step of the set of putative steps; determining a sequence for the set of playbook steps based on an ordering of the putative steps within the target set of incident reports and the correspondences between the putative steps and the identified set of clusters; and displaying, on a user interface, an indication of the set of playbook steps according to the determined sequence for the set of playbook steps.

Abstract: A system may include persistent storage containing representations of requests associated with a managed network. The persistent storage may include lists of capabilities associated with agents, and each request may include a textual description of a situation experienced by a user and a resolution of the situation by a particular agent. A computing device may obtain a set of requests from the persistent storage, apply an unsupervised machine learning clustering technique to textual descriptions included in the set of requests, and arrange the requests into groups such that each group contains requests including textual descriptions with at least a threshold degree of similarity to one another. The computing device may perform, for the requests in a particular group, a textual analysis on associated resolutions to identify capabilities used by agents to resolve the requests, and update the lists of capabilities to associate the capabilities with agents that used them.

Abstract: A system may include persistent storage containing representations of requests associated with a managed network. The persistent storage may include lists of capabilities associated with agents, and each request may include a textual description of a situation experienced by a user and a resolution of the situation by a particular agent. A computing device may obtain a set of requests from the persistent storage, apply an unsupervised machine learning clustering technique to textual descriptions included in the set of requests, and arrange the requests into groups such that each group contains requests including textual descriptions with at least a threshold degree of similarity to one another. The computing device may perform, for the requests in a particular group, a textual analysis on associated resolutions to identify capabilities used by agents to resolve the requests, and update the lists of capabilities to associate the capabilities with agents that used them.