Abstract: A method, a computer program product, and a computer system assign an operator to service an incident. The method includes determining a type of incident. The method includes determining a command group based on the type of incident according to a first mapping. The first mapping is indicative of a mapping between the command group and the type of incident based on historical resolutions of historical incidents. The command group includes at least one command used in resolving the type of incident for a historical incident. The method includes determining an operator who has used the command group according to a second mapping. The second mapping is indicative of a mapping between the command group and the operator based on historical resolutions of historical incidents. The operator has used at least one command in the command group. The method includes assigning the operator to the incident.

Abstract: Generation, by machine logic, of runbooks for problem events. Generation of runbooks including the following operations: receiving operator commands in a command line interface for an event group relating to an issue, wherein the operator commands resolve the issue; and storing the operator commands as related artifacts of the event group with mapping to affected resources. The method may match arguments of the operator commands to event metadata fields of events in the event group to generalize the arguments to the event metadata and to generate a runbook of generalized operator commands for future instances of an event group of a similar type.