Abstract: Operational metrics of a distributed collection of servers in a cloud environment are analyzed by a service to intelligently machine learn which operational metric is highly correlated to incidents or failures in the cloud environment. To do so, metric values of the operational metrics are analyzed over time by the service to check whether the operation metrics exceed a particular metric threshold. If so, the service also checks whether such spikes in the operation metric above the metric thresholds occurred during known cloud incidents. Statistics are calculated reflecting the number of times the operational metrics spiked during times of cloud incidents and spiked during times without cloud incidents. Correlation scores based on these statistics are calculated and used to select the correlated operational metrics that are most correlated to cloud failures.

Abstract: Techniques are described herein that are capable of generating a mitigation workflow for a computing service using historical mitigation workflows. A determination is made that a historical technical issue that was encountered by a first computing service corresponds to a current technical issue that is encountered by a second computing service. A workflow, which is configured to mitigate the current technical issue, is generated to include historical mitigation operations that are included in historical mitigation workflows that were performed to mitigate the historical technical issue based at least in part on the historical technical issue corresponding to the current technical issue.

Abstract: The present disclosure relates to systems and methods that provide recommendations to service owners on what actions to take to modify a service of the service owners. The systems and methods analyze the service owner’s workload and telemetry from the services worked on by the service owners. The systems and methods provide recommendations with actions to take to modify the service based on a predicted outcome of the recommendations.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: Methods and systems described herein correlate an incoming alert, regarding events that affect service performance, availability, and security in a cloud services platform, with an existing incident record, stored in remote storage, to enable improved incident handling. Alert information is applied to machine-learning models to correlate the incoming alert to a parent incident record. In rule-based correlation, a local cache stores query signatures (keys) and information related to respective incident records (values). A correlation rule is retrieved for the alert, and a correlation query is constructed based on the alert and the rule. A query signature is generated and used as a cache key to access information about a respective parent incident in storage. If the parent information is not found in the cache, the remote storage is searched for the parent incident record using the correlation query. The alert and correlated parent incident record are associated in remote storage.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for detecting a common root cause for a multi-resource outage in a computing environment. For example, incident reports associated with multiple resources and that are generated by a plurality of monitors are featurized and provided to a classification model. The classification model detects whether a multi-resource outage exists based on the featurized incident reports and identifies a subset of the incident reports upon which the detection is based. Upon detecting a multi-resource outage, an analysis is performed to determine a potential common root cause of the multi-resource outage.

Abstract: Operational metrics of a distributed collection of servers in a cloud environment are analyzed by a service to intelligently machine learn which operational metric is highly correlated to incidents or failures in the cloud environment. To do so, metric values of the operational metrics are analyzed over time by the service to check whether the operation metrics exceed a particular metric threshold. If so, the service also checks whether such spikes in the operation metric above the metric thresholds occurred during known cloud incidents. Statistics are calculated reflecting the number of times the operational metrics spiked during times of cloud incidents and spiked during times without cloud incidents. Correlation scores based on these statistics are calculated and used to select the correlated operational metrics that are most correlated to cloud failures.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: Operational metrics of a distributed collection of servers in a cloud environment are analyzed by a service to intelligently machine learn which operational metric is highly correlated to incidents or failures in the cloud environment. To do so, metric values of the operational metrics are analyzed over time by the service to check whether the operation metrics exceed a particular metric threshold. If so, the service also checks whether such spikes in the operation metric above the metric thresholds occurred during known cloud incidents. Statistics are calculated reflecting the number of times the operational metrics spiked during times of cloud incidents and spiked during times without cloud incidents. Correlation scores based on these statistics are calculated and used to select the correlated operational metrics that are most correlated to cloud failures.

Abstract: Examples described herein generally relate to identifying a set of service events corresponding to an incident report, querying a multiple-layer relational graph to determine one or more other service events related to the set of service events, detecting a pattern in the set of service events and a subset of the one or more other service events, and indicating, via a user interface and based on the incident report, the subset of the one or more other service events as related to the incident report.

Abstract: Methods, systems, and computer program products are provided for identifying configuration parameters for generating issues in a computing environment. A data retriever is configured to retrieve, from a data store, past incident data relating to past alerts in the computing environment. A configuration optimizer generates a configuration change based at least on an evaluation of the past incident data. For instance, the configuration change can be a recommended change to one or more configuration settings of a monitoring system and/or an incident management system. An incident volume change is predicted under an assumption the configuration change is implemented. Based at least on the incident volume change, the configuration change can be provided for implementation on an alerting system.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: Described herein are various technologies pertaining to providing assistance to an operator in a data center with respect to failures in the data center. An alarm is received, and a failing device is identified based upon content of the alarm. Failure conditions of the alarm are mapped to a failure symptom that may be exhibited by the failing device, and troubleshooting options previously employed to mitigate the failure symptom are retrieved from historical data. Labels are respectively assigned to the troubleshooting options, where a label is indicative of a probability that a troubleshooting option to which the label has been assigned will mitigate the failure symptom.

Abstract: Methods for automatic and intelligent incident routing are performed by systems and apparatuses. The methods intelligently optimize routing of incidents to correct owners from a pool of many possible owners by utilizing learning models and algorithms based on feature vectors. Users provide information related to incidents of services or systems. The information is cleaned and featurized to generate a feature vector for the incident. The systems and apparatuses intelligently and automatically determine sets of candidate recipients based on outputs of algorithms, e.g., machine learning algorithms, such as classifiers using the feature vectors as inputs. Classifiers may utilize models or algorithms trained with featurizations used for feature vectors. Sets of candidate recipients are provided to users for selection of a recipient for the information from the set of candidate recipients instead of from all the possible recipients.

Abstract: Computing systems for efficient incident management in large scale computer systems are described herein. In one embodiment, an incident management system can be configured to, in response to receiving a user input requesting an unidentified incident management service, convert an alphanumerical string of the user input into a pixelated matrix having multiple pixels individually corresponding to a character or number in the alphanumerical string. The incident management system can then feed the converted pixelated matrix into a neural network to identify one or more incident management services corresponding to the received user input with a corresponding probability value. The incident management system can then perform an application programming interface (API) call to execute a computer application to provide one of the identified incident management services to the user.

Abstract: Methods, systems, and computer program products are provided for generating an actionability measure for events occurring in a computing environment. A data retriever is configured to receive, in an event management system, an event indication generated in the computing environment regarding an event. In implementations, the event indication includes characteristics relating to the generation of the event. An actionability measure generator is configured to analyze the characteristics relating to the generation of the event. The actionability measure generator generates an actionability measure for the event indication based at least on the analysis of the characteristics, where the actionability measure defines an action level for the event indication. An automated action executor executes an action in the event management system for changing a state of the event indication that is dependent on the generated actionability measure.

Abstract: Examples described herein generally relate to identifying a set of service events corresponding to an incident report, querying a multiple-layer relational graph to determine one or more other service events related to the set of service events, detecting a pattern in the set of service events and a subset of the one or more other service events, and indicating, via a user interface and based on the incident report, the subset of the one or more other service events as related to the incident report.

Abstract: A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Abstract: Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable “smart” network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures.

Abstract: A system and method is provided for generating a dynamic comprehensive domain review. A domain review engine obtains authoritative literature associated with a domain to extract insights using entity recognition and relationship extraction, and ranks the extracted results to generate a dynamic domain review.