System and method for AI based incident impact and root cause analysis

1 . A method for reducing data record processing in incident report generation, comprising:

accessing a plurality of event records, each event record generated based on an event involving one or more resources in a computing environment;

parsing each event record based on a predetermined data field, the predetermined data field containing a data value representative of a type of feature of an event;

extracting from each predetermined data field a data value;

correlating a group of event records of the plurality of event records based on at least an extracted data value;

generating an incident data record based on the extracted data values of the correlated group of event records, wherein the incident data record is representative of an incident associated with events in the correlated group of event records;

generating a prompt based on the incident data record;

processing the generated prompt utilizing a large language model (LLM);

generating an incident report, including an incident summary and an analysis of a root cause of the incident; and

outputting the incident report in textual form to a user.

2 . The method of claim 1 , further comprising:

generating the prompt further based on the incident data record and context data of a data source, wherein the data source generated a portion of the correlated group of event records.

3 . The method of claim 1 , further comprising:

storing in the incident data record only the extracted data values of the correlated group of event records.

4 . The method of claim 1 , further comprising:

generating the prompt further based on a prompt template, the prompt template including an input which, when executed by the LLM, outputs any one of: an incident title, an incident summary, a root cause analysis, a root cause reasoning, and a combination thereof.

5 . The method of claim 4 , further comprising:

generating the incident title, the incident summary, the root cause analysis, and root cause reasoning, utilizing a first LLM; and

generating a summarized: incident title, incident summary, root cause analysis, root cause reasoning, and a combination thereof, utilizing a second LLM.

6 . The method of claim 5 , wherein the first LLM includes a first context length, and the second LLM includes a second context length.

7 . The method of claim 4 , further comprising:

generating the prompt for the root cause analysis based on any one of: a generated incident summary, the correlated group of event records, and a combination thereof.

8 . The method of claim 4 , further comprising:

generating the prompt for the root cause reasoning based on: a root cause analysis, an incident summary, the correlated group of event records, and a combination thereof.

9 . The method of claim 1 , wherein the predetermined data field is a tag.

10 . The method of claim 1 , wherein the type of feature is an identity of a resource involved in an event.

11 . The method of claim 1 , wherein the type of feature is a time an event occurs.

12 . A system for reducing data record processing in incident report generation comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

access a plurality of event records, each event record generated based on an event involving one or more resources in a computing environment;

parse each event record based on a predetermined data field, the predetermined data field containing a data value representative of a type of feature of an event;

extract from each predetermined data field a data value;

correlate a group of event records of the plurality of event records based on at least an extracted data value;

generate an incident data record based on the extracted data values of the correlated group of event records, wherein the incident data record is representative of an incident associated with events in the correlated group of event records;

generate a prompt based on the incident data record;

process the generated prompt utilizing a large language model (LLM);

generating an incident report, including an incident summary and an analysis of a root cause of the incident; and

outputting the incident report in textual form to a user.

13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate the prompt further based on the incident data record and context data of a data source, wherein the data source generated a portion of the correlated group of event records.

14 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

store in the incident data record only the extracted data values of the correlated group of event records.

15 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate the prompt further based on a prompt template, the prompt template including an input which, when executed by the LLM, outputs any one of:

an incident title, an incident summary, a root cause analysis, a root cause reason, and a combination thereof.

16 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate the incident title, the incident summary, the root cause analysis, and root cause reasoning, utilizing a first LLM; and

generate a summarized:

incident title, incident summary, root cause analysis, root cause reason, and a combination thereof, utilizing a second LLM.

17 . The system of claim 16 , wherein the first LLM includes a first context length, and the second LLM includes a second context length.

18 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate the prompt for the root cause analysis based on any one of:

a generated incident summary, the correlated group of event records, and a combination thereof.

19 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate the prompt for the root cause reasoning based on:

a root cause analysis, an incident summary, the correlated group of event records, and a combination thereof.

20 . The system of claim 12 , wherein the predetermined data field is a tag.

21 . A non-transitory computer-readable medium storing a set of instructions for reducing data record processing in incident report generation, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

access a plurality of event records, each event record generated based on an event involving one or more resources in a computing environment;

parse each event record based on a predetermined data field, the predetermined data field containing a data value representative of a type of feature of an event;

extract from each predetermined data field a data value;

correlate a group of event records of the plurality of event records based on at least an extracted data value;

generate an incident data record based on the extracted data values of the correlated group of event records, wherein the incident data record is representative of an incident associated with events in the correlated group of event records;

generate a prompt based on the incident data record;

process the generated prompt utilizing a large language model (LLM);

generating an incident report, including an incident summary and an analysis of a root cause of the incident; and

outputting the incident report in textual form to a user.