Abstract: An example embodiment includes determining, from a set of entries stored in a memory, a set of performed actions; identifying clusters of similar actions within the set of performed actions based on multidimensional vector embeddings of the performed actions, wherein each of the performed actions is a member of one of the clusters, and wherein each of the clusters contains at least one of the performed actions; determining a sequence for the clusters based on orderings of the performed actions within the set of entries and the membership of the performed actions within the clusters; and providing for display, on a user interface, representations of the performed actions within the clusters, wherein the representations of the performed actions are ordered according to the determined sequence for the clusters.

Abstract: An embodiment may involve: obtaining textual content including a plurality of token strings, wherein each of the plurality of token strings includes one or more tokens; determining, for the plurality of token strings, respectively corresponding sets of n-gram tuples; assigning respective weights to the plurality of token strings, wherein, for each of the plurality of token strings, the assignment is based on the respectively corresponding set of n-gram tuples; identifying a subset of the plurality of token strings, wherein each of the subset of the plurality of token strings is characterized by a respective weight that exceeds a predetermined threshold weight; and storing sets of n-gram tuples respectively corresponding to the subset of the plurality of token strings.

Abstract: An example embodiment includes determining, from a target set of incident reports, a set of putative steps; determining a set of playbook steps by identifying a set of clusters within the set of putative steps, wherein each playbook step of the set of playbook steps corresponds to a respective cluster within the identified set of clusters, and wherein each cluster within the identified set of clusters contains at least one putative step of the set of putative steps; determining a sequence for the set of playbook steps based on an ordering of the putative steps within the target set of incident reports and the correspondences between the putative steps and the identified set of clusters; and displaying, on a user interface, an indication of the set of playbook steps according to the determined sequence for the set of playbook steps.

Abstract: A system may include persistent storage containing representations of requests associated with a managed network. The persistent storage may include lists of capabilities associated with agents, and each request may include a textual description of a situation experienced by a user and a resolution of the situation by a particular agent. A computing device may obtain a set of requests from the persistent storage, apply an unsupervised machine learning clustering technique to textual descriptions included in the set of requests, and arrange the requests into groups such that each group contains requests including textual descriptions with at least a threshold degree of similarity to one another. The computing device may perform, for the requests in a particular group, a textual analysis on associated resolutions to identify capabilities used by agents to resolve the requests, and update the lists of capabilities to associate the capabilities with agents that used them.

Abstract: A system may include persistent storage containing representations of requests associated with a managed network. The persistent storage may include lists of capabilities associated with agents, and each request may include a textual description of a situation experienced by a user and a resolution of the situation by a particular agent. A computing device may obtain a set of requests from the persistent storage, apply an unsupervised machine learning clustering technique to textual descriptions included in the set of requests, and arrange the requests into groups such that each group contains requests including textual descriptions with at least a threshold degree of similarity to one another. The computing device may perform, for the requests in a particular group, a textual analysis on associated resolutions to identify capabilities used by agents to resolve the requests, and update the lists of capabilities to associate the capabilities with agents that used them.