US 12,093,867 B2
Incident management in information technology systems
Jack Richard Buggins, London (GB); Caelum Jayd Forder, Cork City (IE); Mandeep Chana, Wokingham (GB); and Viraj Jayeshkumar Vyas, Manchester (GB)
Assigned to International Business Machines Corporation, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Jun. 25, 2021, as Appl. No. 17/358,047.
Prior Publication US 2022/0414571 A1, Dec. 29, 2022
Int. Cl. G06Q 10/0631 (2023.01); G06F 16/2458 (2019.01); G06F 16/28 (2019.01)
CPC G06Q 10/06316 (2013.01) [G06F 16/2465 (2019.01); G06F 16/285 (2019.01); G06F 2216/03 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A computer-implemented method for an operations management system, the method comprising:
obtaining user activity information representing user interactions with the operations management system responsive to an information technology system operational incident, the incident belonging to a category of incidents;
processing the user activity information as an itemset using a pure Boolean one-hot encoding operation;
collecting dismissive information indicative of information dismissal associated with a user dismissal of log data, topology data, metrics data, and runbook entries, wherein the collecting of dismissive information is selected from the group consisting of: eye tracking, and gaze detection, wherein, based on the dismissive information, undesired and/or irrelevant information is automatically prevented from being supplied to the user in response to a subsequent occurrence of a future incident of a same or similar type, category, or nature of the incident;
processing the itemset with a mining algorithm to identify:
one or more items of information frequently accessed for the incident; and
a surplus item of information frequently disregarded for the incident using the dismissive information;
disassociating of the surplus item of information with the category of incidents to modify the category of incidents;
associating the identified one or more items of information frequently accessed for the incident with the category of incidents to further modify the category of incidents;
providing the further modified category of incidents to mitigate a subsequent information technology system operational incident; and
outputting the further modified category of incidents to a user via a user interface;
wherein the user activity information includes: browsing and exploring log data, topology data, metrics data, and runbook entries pertaining to an incident.