Abstract: Described systems and techniques provide fast, efficient, and cost-effective techniques for detecting anomalous behaviors of monitored objects. Multiple hashing algorithms, each providing multiple hash bins, may be used to generate a unique hash signature for each of the monitored objects. Metric values characterizing the behavior of the monitored objects may be aggregated within individual ones of the multiple hash bins of each of the multiple hashing algorithms. Then, one or more machine learning models may be trained using the unique hash signatures and their included, aggregated metric values. During subsequent scoring using the trained machine learning model(s), each of the aggregated metric values of each of the hash bins may be scored, and a single or small subset of anomalous objects may be identified.

Abstract: When a restart event is detected within a technology landscape, restart-impacted performance metrics and non-restart-impacted performance metrics may be identified. The non-restart-impacted performance metrics may continue to be included within a performance characterization of the technology landscape. The restart-impacted performance metrics may be monitored, while being excluded from the performance characterization. The restart-impacted performance metric of the restart-impacted performance metrics may be transitioned to a non-restart-impacted performance metric, based on a monitored value of the restart-impacted performance metric following the restart event.

Abstract: An event graph schema for a technology landscape may be determined, where the technology landscape is characterized using scores assigned to performance metrics. The event graph schema may include a plurality of nodes corresponding to the performance metrics and the scores, and directional edges connecting node pairs of the plurality of nodes, with each directional edge having a score-dependent validity criteria defined by scores of a corresponding node pair. Anomalous scores associated with an event within the technology landscape may be used to find anomalous nodes. Valid edges connecting two of the anomalous nodes and satisfying the score-dependent validity criteria thereof may be used to determine at least one path that includes the valid edges and connected anomalous nodes. In this way, it is possible to traverse the at least one path to identify at least one of the connected anomalous nodes as a root cause node of the event.

Abstract: An event graph schema for a technology landscape may be determined, where the technology landscape is characterized using scores assigned to performance metrics. The event graph schema may include a plurality of nodes corresponding to the performance metrics and the scores, and directional edges connecting node pairs of the plurality of nodes, with each directional edge having a score-dependent validity criteria defined by scores of a corresponding node pair. Anomalous scores associated with an event within the technology landscape may be used to find anomalous nodes. Valid edges connecting two of the anomalous nodes and satisfying the score-dependent validity criteria thereof may be used to determine at least one path that includes the valid edges and connected anomalous nodes. In this way, it is possible to traverse the at least one path to identify at least one of the connected anomalous nodes as a root cause node of the event.

Abstract: When a restart event is detected within a technology landscape, restart-impacted performance metrics and non-restart-impacted performance metrics may be identified. The non-restart-impacted performance metrics may continue to be included within a performance characterization of the technology landscape. The restart-impacted performance metrics may be monitored, while being excluded from the performance characterization. The restart-impacted performance metric of the restart-impacted performance metrics may be transitioned to a non-restart-impacted performance metric, based on a monitored value of the restart-impacted performance metric following the restart event.

Abstract: When a restart event is detected within a technology landscape, restart-impacted performance metrics and non-restart-impacted performance metrics may be identified. The non-restart-impacted performance metrics may continue to be included within a performance characterization of the technology landscape. The restart-impacted performance metrics may be monitored, while being excluded from the performance characterization. The restart-impacted performance metric of the restart-impacted performance metrics may be transitioned to a non-restart-impacted performance metric, based on a monitored value of the restart-impacted performance metric following the restart event.

Abstract: An event graph schema for a technology landscape may be determined, where the technology landscape is characterized using scores assigned to performance metrics. The event graph schema may include a plurality of nodes corresponding to the performance metrics and the scores, and directional edges connecting node pairs of the plurality of nodes, with each directional edge having a score-dependent validity criteria defined by scores of a corresponding node pair. Anomalous scores associated with an event within the technology landscape may be used to find anomalous nodes. Valid edges connecting two of the anomalous nodes and satisfying the score-dependent validity criteria thereof may be used to determine at least one path that includes the valid edges and connected anomalous nodes. In this way, it is possible to traverse the at least one path to identify at least one of the connected anomalous nodes as a root cause node of the event.

Abstract: A technology landscape may be characterized using a performance characterization that includes scores assigned to performance metrics for the technology landscape and using at least one trained machine learning model. In response to a detected calibration trigger, a calibratable performance metric of the performance metrics may be determined. A relationship may be determined between conforming values of the calibratable performance metric during a conforming period for which the at least one trained machine learning model was trained, and non-conforming values of the calibratable performance metric occurring during a calibration period initiated by the calibration trigger. In this way, a score assigned to the calibratable performance metric may be calibrated, based on the relationship.

Abstract: When a restart event is detected within a technology landscape, restart-impacted performance metrics and non-restart-impacted performance metrics may be identified. The non-restart-impacted performance metrics may continue to be included within a performance characterization of the technology landscape. The restart-impacted performance metrics may be monitored, while being excluded from the performance characterization. The restart-impacted performance metric of the restart-impacted performance metrics may be transitioned to a non-restart-impacted performance metric, based on a monitored value of the restart-impacted performance metric following the restart event.

Abstract: A data stream of performance metrics characterizing a technology landscape may be received. From a plurality of performance prediction models and based on the performance metrics, a subset of performance prediction models may be selected. The subset of performance prediction models may be combined into a composite prediction model. The composite prediction model may be loaded into a model processor for scoring against the data stream of performance metrics to obtain a performance prediction for the technology landscape based thereon.