Abstract: A cognitive automation engine receives notice that an unexpected event has occurred in a computing environment. The engine tries to address any resulting problems by running a previously generated automation script, customizing the script as required through cognitive means. If this fails, the engine forwards the script to a human expert for customization. In either case, the engine records any customization activities, extracts parameters from the recording that identify each customization step, cognitively assigns a level of risk to each step based on historical precedent, and determines whether running the customized script presents an unacceptable risk of adverse results. The system adds the revisions, other script-related information, and any results of running the revised script Loin a training corpus. The corpus is then incorporated into a machine-learning procedure that teaches the automation engine how to more intelligently customize a script the next time a similar event occurs.

Abstract: Techniques regarding identifying one or more systems where a policy as a code can be applicable are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise a matching component, operatively coupled to the processor, that can determine whether a policy as a code is enforceable on a computing entity based on a comparison of a plurality of commands executed on the computing entity and a plurality of actions extracted from the code.

Abstract: Systems, computer-implemented methods and/or computer program products that facilitate protecting data security through hierarchical authorization analysis are provided. In one embodiment, a computer-implemented method comprises generating, by a system operatively coupled to a processor, a model by extracting properties of data transmitted from executing an application to learn repeated patterns; and performing, by the system, a fine-grained authorization audit by comparing the data with the model.

Abstract: Embodiments of the present invention provide computer-implemented methods, computer program products and systems. Embodiments of the present invention can receive position and location information. Embodiments of the present invention can generate a risk score for one or more maneuvers associated with a predicted trajectory of a vehicle. Embodiments of the present invention can generate a visual representation for each of the one or more maneuvers associated with the predicted trajectory of the vehicle based on the generated risk score associated with each maneuver. Embodiments of the present invention can integrate the generated visual representation into a user display.

Abstract: The invention relates to a computer-implemented method for processing events. The method provides a database comprising original event objects stored in association with canonical event objects. The method executes a learning algorithm on the associated original and canonical event objects for generating a trained ML program adapted to transform an original event object of any one of the one or more original data formats into a canonical event object having the canonical data format and uses the trained machine learning program for automatically transforming original event objects generated by an active IT-monitoring system into canonical event objects processable by an event handling system.

Abstract: A technique relates to computer artifacts in a computer system. The technique includes creating a list of insights from artifacts, determining a similarity level between the insights of the artifacts and a predefined area of capability, comparing similarity level of insights for each of the artifacts to a threshold metric, removing artifacts having the similarity level below threshold metric such that artifacts remaining meet the threshold metric, and performing a pair-wise similarity comparison on the artifacts remaining which compares insights of the artifacts to each other to determine which ones are least common. The technique includes creating feature vectors for artifacts that are least common, determining a feature vector having a most variation in feature vectors, an artifact associated with the feature vector being determined to comprise a unique insight, and generating a unique message using the artifact associated with the feature vector being the unique insight.

Abstract: A computer system, non-transitory computer storage medium, and a computer-implemented method of assessing technical risk using visual pattern recognition in an Information Technology (IT) Service Management System. A data visualization engine and a time series generation engine receive the operational data, respectively. A first representation of the data is generated by the data visualization engine, and a second representation of the data is generated by the time series generation engine. Anomaly patterns are identified by a pattern recognition engine configured to perform feature extraction and data transformation. An ensembler is configured to accept the outputs from two AI anomaly engines and make a final decision of whether anomaly patterns are captured. Risk scores based on the identified anomaly patterns are output by a pattern recognition engine to an automated management system. The anomalies includes information regarding vulnerabilities of devices or components of the IT Service Management System.

Abstract: Techniques that facilitate feedback loop learning between artificial intelligence systems are provided. In one example, a system includes a monitoring component and a machine learning component. The monitoring component identifies a data pattern associated with data for an artificial intelligence system. The machine learning component compares the data pattern to historical data patterns for the artificial intelligence system to facilitate modification of at least a component of the artificial intelligence system and/or one or more dependent systems of the artificial intelligence system.

Abstract: Embodiments are directed to computer-implemented methods of operating a monitoring host of a performance management infrastructure. The method includes receiving, using natural language processing (NLP) algorithms, training data that includes operational data and functionality data. The operational data represents natural language descriptions of performance problems identified for an application computer program running a computing system. The functionality data represents natural language descriptions of functional capabilities of the application computer program. The NLP algorithms and a classifier are used to extract features of the training data. The extracted features are used to build a semantic correlation model that includes correlated data sets, wherein each of the correlated data sets includes functionality data and operational data having a semantic correlation to functionality data.

Abstract: A system and associated method may utilize a processor that receives recall product instance group (RPIG) information (RPIGI) identifying a set of instances of products having a product type identifier (PTI) that are a subject of a product recall. The processor receives, from an imaging device associated with a user, an image containing a product instance. The method further comprises applying a classifier and determining a PTI. Based on the image, secondary product information is also identified. These may be compared with the RPIGI to determine a product instance membership. Information related to the product instance membership in the RPIG may be displayed.

Abstract: A technique relates to computer artifacts in a computer system. The technique includes creating a list of insights from artifacts, determining a similarity level between the insights of the artifacts and a predefined area of capability, comparing similarity level of insights for each of the artifacts to a threshold metric, removing artifacts having the similarity level below threshold metric such that artifacts remaining meet the threshold metric, and performing a pair-wise similarity comparison on the artifacts remaining which compares insights of the artifacts to each other to determine which ones are least common. The technique includes creating feature vectors for artifacts that are least common, determining a feature vector having a most variation in feature vectors, an artifact associated with the feature vector being determined to comprise a unique insight, and generating a unique message using the artifact associated with the feature vector being the unique insight.

Abstract: A method for providing a resolution to an open issue is described. The method includes utilizing structured corresponding learning to determine pivots from a database having historical data records to determine data records having similar open issues and providing their resolution. The method further includes providing a recommended resolution for the open issue based on the historical data records.

Abstract: A method for predicting an impact of a service level agreement including collecting workload data and effort data and constructing a cost model for the service level agreement, defining a baseline service parameter corresponding to the code model of the service level agreement, and calibrating the cost model of the service level agreement, by calibrating a workload volume from the workload data and an effort time from the effort data to match the baseline service parameter, to output a service level agreement impact model.

Abstract: Systems, computer-implemented methods, and computer program products that can facilitate refinement of a predicted event based on explainability data are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise an interpreter component that identifies a probable cause of a predicted event based on explainability data. The computer executable components can further comprise an enrichment component that executes a diagnostic analysis based on the probable cause.

Abstract: Techniques regarding identifying one or more systems where a policy as a code can be applicable are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise a matching component, operatively coupled to the processor, that can determine whether a policy as a code is enforceable on a computing entity based on a comparison of a plurality of commands executed on the computing entity and a plurality of actions extracted from the code.

Abstract: A cognitive automation engine receives notice that an unexpected event has occurred in a computing environment. The engine tries to address any resulting problems by running a previously generated automation script, customizing the script as required through cognitive means. If this fails, the engine forwards the script to a human expert for customization. In either case, the engine records any customization activities, extracts parameters from the recording that identify each customization step, cognitively assigns a level of risk to each step based on historical precedent, and determines whether running the customized script presents an unacceptable risk of adverse results. The system adds the revisions, other script-related information, and any results of running the revised script in a training corpus. The corpus is then incorporated into a machine-learning procedure that teaches the automation engine how to more intelligently customize a script the next time a similar event occurs.

Abstract: Embodiments are directed to computer-implemented methods of operating a monitoring host of a performance management infrastructure. The method includes receiving, using natural language processing (NLP) algorithms, training data that includes operational data and functionality data. The operational data represents natural language descriptions of performance problems identified for an application computer program running a computing system. The functionality data represents natural language descriptions of functional capabilities of the application computer program. The NLP algorithms and a classifier are used to extract features of the training data. The extracted features are used to build a semantic correlation model that includes correlated data sets, wherein each of the correlated data sets includes functionality data and operational data having a semantic correlation to functionality data.

Abstract: Systems, computer-implemented methods and/or computer program products that facilitate protecting data security through hierarchical authorization analysis are provided. In one embodiment, a computer-implemented method comprises generating, by a system operatively coupled to a processor, a model by extracting properties of data transmitted from executing an application to learn repeated patterns; and performing, by the system, a fine-grained authorization audit by comparing the data with the model.

Abstract: A system and method for reducing service latency includes dividing an information technology service for a customer into an infrastructure management service and a data management service. Data associated with the information technology service is stored in a backup memory. A set of infrastructure images related to the information technology service is stored at a cloud service provider. The infrastructure images are updated with software updates and hardware updates, as needed, and the data associated with the information technology service is updated through backup and restore mechanisms. The set of infrastructure images that have been updated with data with latest updates are started for recovery, continuity, testing, etc.

Abstract: A method includes obtaining, from a service management database, one or more change tickets and one or more incident tickets relating to an information technology infrastructure, defining one or more change-incident pairs based on linkages between the incident tickets and the change tickets, identifying, from the change-incident pairs, one or more dimensions affecting outcomes of implementation of one or more change types, generating at least one recommendation for altering implementation of subsequent changes of a given change type to the information technology infrastructure based on the identified dimensions, applying the at least one recommendation to the implementation of one or more subsequent changes of the given change type to configuration items in the information technology infrastructure, monitoring the information technology infrastructure to determine outcomes of the subsequent changes of the given change type, and modifying the at least one recommendation responsive to the monitoring.