Abstract: In an approach to linking operational data with issues, a new event is received. The new event is associated to a story, where the story is related to an identified problem within the system, and further where the new event is associated with the story using machine learning techniques. The story is associated to related change requests based on a similarity between the story and related change requests, where the similarity between the story and the related change requests is associated using the machine learning techniques. A cost is calculated for the story. Responsive to associating the new event with a specific change request, the priority of the specific change request is updated based on the cost for the story.

Abstract: A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Abstract: Methods, computer program products, and/or systems are provided that perform the following operations: in an information technology (IT) management system, grouping one or more ongoing service failure events into a service failure record; identifying a representative event for the service failure record; identifying one or more conversations that relate to the one or more ongoing service events; computing, using a similarity algorithm, feature similarity scores for respective conversations of the one or more conversations based, at least in part, on the features associated with the representative event and features associated with the respective conversations; linking a subset of the one or more conversations to the one or more ongoing service events in the service failure record based, at least in part, on the computed feature similarity scores; and providing the service failure record to a collaboration platform utilized in addressing the one or more ongoing service events.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate proactive operational risk assessment of a proposed change in a computing environment are provided. According to an embodiment, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise an extraction component that identifies change events in historic operational data that induced one or more incidents in a computing environment. The computer executable components further comprise an assessment component that employs a model to assign a change risk assessment score to a defined change in the computing environment based on the change events.

Abstract: In an approach to linking operational data with issues, a new event is received. The new event is associated to a story, where the story is related to an identified problem within the system, and further where the new event is associated with the story using machine learning techniques. The story is associated to related change requests based on a similarity between the story and related change requests, where the similarity between the story and the related change requests is associated using the machine learning techniques. A cost is calculated for the story. Responsive to associating the new event with a specific change request, the priority of the specific change request is updated based on the cost for the story.

Abstract: An approach to recommending corrective action to computing system event errors. The approach may include generating a textual description of an event error. The approach may include transforming the textual description into feature vectors with a domain-specific word embedding module. The approach may also include generating a recommendation to correct the event error based on an analysis of the feature vectors. Additionally, the recommendation may be presented for verification.

Abstract: Systems, computer-implemented methods, and computer program products that facilitate synthetic system fault generation are provided. According to an embodiment, a system can comprise a processor that executes the following computer-executable components stored in a non-transitory computer readable medium: a generator component that employs a trained artificial intelligence (AI) model to generate a synthetic system fault, represented as a combination of discrete parameters and continuous parameters that define a system state; and a fault assembler component that analyzes the synthetic system fault and generates textual content corresponding to the synthetic system fault.

Abstract: Systems, devices, computer-implemented methods, and/or computer program products that facilitate fault localization for distributed applications. In one example, a system can comprise a process that executes computer executable components stored in memory. The computer executable components can comprise a graph compiler and a partitioning component. The graph compiler can generate a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors. The distributed application can comprise the services. The partitioning component can cluster the services into a plurality of groups using the hypernode graph and an objective function.

Abstract: Embodiments of the present invention provide methods, computer program products, and systems. Embodiments of the present invention can dynamically determine one or more endpoints to fulfill a user request. Embodiments of the present invention can select the dynamically determined one or more endpoints as the one or more endpoints that fulfill the user request. Embodiments of the present invention can execute the selected one or more endpoints to fulfill the user request.

Abstract: A method, a computer system, and a computer program product for a shiftleft topology construction is provided. Embodiments of the present invention may include collecting datasets. Embodiments of the present invention may include extracting topological entities from the datasets. Embodiments of the present invention may include correlating a plurality of data from the topological entities. Embodiments of the present invention may include mapping the topological entities. Embodiments of the present invention may include marking entry points for a plurality of subgraphs of the topological entities. Embodiments of the present invention may include constructing a topology graph.

Abstract: A computer implemented method for identifying an application topology includes identifying a sandbox environment corresponding to an application of interest, analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicating a first topology, identifying a production system corresponding to the application of interest, querying the production system to identify a set of structural dependencies indicating a second topology, and creating a complete topology of the cloud application by combining the first topology and the second topology. A computer program product and computer system for identifying an application topology are additionally disclosed herein.

Abstract: Several aspects are provided for dynamically updating an alert-management system that uses a master ruleset to match alerts in a data processing system with automata for handling the alerts. A method comprises training a machine learning model to correlate the alerts with the automata using a training dataset comprising alerts which were successfully handled by the automata. The machine learning model is then applied to correlate unmatched alerts with the automata, wherein the unmatched alerts were not matched to the automata by the master ruleset. The method further comprises analyzing operation of the machine learning model in relation to correlation of the unmatched alerts to define a new ruleset for matching the unmatched alerts with the automata and outputting the new ruleset for auditing of each rule in the new ruleset. In response to approval of an audited rule, the audited rule is added to the master ruleset.

Abstract: An approach to recommending corrective action to computing system event errors. The approach may include generating a textual description of an event error. The approach may include transforming the textual description into feature vectors with a domain-specific word embedding module. The approach may also include generating a recommendation to correct the event error based on an analysis of the feature vectors. Additionally, the recommendation may be presented for verification.

Abstract: A computer-implemented method of cross-environment event correlation includes determining one or more correlated events about an issue across a plurality of domains. A knowledge data is extracted from the issue determined from the one or more correlated events is performed. A correlation graph is generated from the extracted knowledge to trace the issue and group the correlated events into one or more event groups to represent their relationship with the issue. A logical reasoning description is constructed based on the generated correlation graph for a domain-space exploration related to how the issue in one domain affects another domain of the plurality of domains. The one or more event groups of correlated events is provided with an explanation about a cause of the issue based on the logical reasoning description.

Abstract: A computer system, non-transitory computer storage medium, and a computer-implemented method of assessing technical risk using visual pattern recognition in an Information Technology (IT) Service Management System. A data visualization engine and a time series generation engine receive the operational data, respectively. A first representation of the data is generated by the data visualization engine, and a second representation of the data is generated by the time series generation engine. Anomaly patterns are identified by a pattern recognition engine configured to perform feature extraction and data transformation. An ensembler is configured to accept the outputs from two AI anomaly engines and make a final decision of whether anomaly patterns are captured. Risk scores based on the identified anomaly patterns are output by a pattern recognition engine to an automated management system. The anomalies includes information regarding vulnerabilities of devices or components of the IT Service Management System.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate discovery of an inexplicit link between a change and an incident in a computing environment are provided. According to an embodiment, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise an analysis component that determines a defined link strength corresponding to links between change data and incident data in a computing environment. The computer executable components further comprise an extraction component that employs a model to identify an inexplicit link between the change data and the incident data based on the defined link strength.

Abstract: A software information analysis system that assesses the operational risks of using a particular set of software is provided. The system identifies one or more software entities used by one or more applications operating in an environment. The system collects information relevant to the identified one or more software entities. The system extracts opinions regarding the identified one or more software entities in the collected information. The system calculates an operational risk metric for the environment based on sentiments expressed in the extracted opinions. Each extracted opinion is weighted based on a personal identity associated with the extracted opinion.

Abstract: A computer implemented method for identifying an application topology includes identifying a sandbox environment corresponding to an application of interest, analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicating a first topology, identifying a production system corresponding to the application of interest, querying the production system to identify a set of structural dependencies indicating a second topology, and creating a complete topology of the cloud application by combining the first topology and the second topology. A computer program product and computer system for identifying an application topology are additionally disclosed herein.

Abstract: A method, a computer system, and a computer program product for mapping operational records to a topology graph. Embodiments of the present invention may include generating an event frequent pattern using operational records. Embodiments of the present invention may include integrating topology-based event frequent patterns. Embodiments of the present invention may include mapping the operational records with an embedding engine. Embodiments of the present invention may include predicting incident events. Embodiments of the present invention may include receiving labeled patterns to the embedding engine for an active learning cycle.

Abstract: Embodiments for intelligent application scenario testing and error detection by a processor. One or more modified application scenarios may be automatically generated from an initial application scenario having configuration data and a plurality of operations relating to an error. The one or more modified application scenarios are variations of the initial application. The one or more modified application scenarios may be executed to detect the existence or non-existence of the error in the one or more modified application scenarios.