Machine learning techniques for providing enriched root causes based on machine-generated data

1. A computer-implemented method for providing an enriched root cause data of an incident using machine-generated textual data, comprising:

extracting from a dataset including machine-generated textual data for a monitored environment, a plurality of features related to a root cause of an incident in the monitored environment;

generating, by a computer, a suitability score for each of a plurality of insights with respect to the incident based on the extracted features and a suitability model, wherein the suitability model is created based on a training set including a plurality of training inputs and a plurality of training outputs, wherein each training output corresponds to at least one of the plurality of training inputs, and wherein the training inputs include a plurality of insight parameters, a plurality of incident parameters, and a plurality of matches between a plurality of training incidences and a plurality of corresponding training insights; and

selecting, by the computer, at least one suitable insight based on the generated suitability scores.

2. The method of claim 1 , wherein the insight parameters include at least one of: an age of each insight, a number of relevant incidences for each insight, a frequency of each insight, a user representation associated with each insight, a source of each insight, and a number of previously matched incidences for each insight.

3. The method of claim 1 , wherein the training outputs include a match between the incident and each of the plurality of insights.

4. The method of claim 1 , wherein each selected insight is a potential textual description of the incident.

5. The method of claim 1 , further comprising:

generating an enriched root cause of the incident based on the root cause and the selected at least one suitable insight.

6. The method of claim 1 , further comprising:

receiving machine-generated textual data from at least one data source, wherein the machine-generated textual data is received from at least one machine in the monitored environment;

classifying the received machine-generated textual data into at least one statistical metric;

processing the at least one statistical metric to recognize a plurality of incidence patterns; and

correlating the plurality of incidence patterns to identify the root cause of the incident, wherein the incident occurred in the monitored environment.

7. The method of claim 6 , wherein classifying the machine-generated textual data into statistical metrics further comprises:

grouping the machine-generated textual data into a plurality of events;

processing each event to determine a plurality of elements embedded therein;

determining a type of each of the plurality of elements; and

determining a statistical metric for each element based on at least the type of the element.

8. The method of claim 1 , wherein the machine-generated textual data includes at least one of: application logs, configuration files, alerts, sensory signals, audit records, and a combination thereof.

9. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for providing an enriched root cause of an incident using machine-generated textual data, the process comprising:

extracting, from a dataset including machine-generated textual data for a monitored environment, a plurality of features related to a root cause of an incident in the monitored environment;

generating, by a computer, a suitability score for each of a plurality of insights with respect to the incident based on the extracted features and a suitability model, wherein the suitability model is created based on a training set including a plurality of training inputs and a plurality of training outputs, wherein each training output corresponds to at least one of the plurality of training inputs, and wherein the training inputs include a plurality of insight parameters, a plurality of incident parameters, and a plurality of matches between a plurality of training incidences and a plurality of corresponding training insights; and

selecting at least one suitable insight based on the generated suitability scores.

10. A system for providing an enriched root cause of an incident using machine-generated textual data, comprising:

a processing circuitry; and

a memory communicatively connected to the processing circuitry, wherein the memory contains instructions that, when executed by the processing circuitry, configure the system to:

extract, from a dataset including machine-generated textual data for a monitored environment, a plurality of features related to a root cause of an incident in the monitored environment;

generate a suitability score for each of a plurality of insights with respect to the incident based on the extracted features and a suitability model, wherein the suitability model is created based on a training set including a plurality of training inputs and a plurality of training outputs, wherein each training output corresponds to at least one of the plurality of training inputs, and wherein the training inputs include a plurality of insight parameters, a plurality of incident parameters, and a plurality of matches between a plurality of training incidences and a plurality of corresponding training insights; and

select at least one suitable insight based on the generated suitability scores.

11. The system of claim 10 wherein the insight parameters include at least one of: an age of each insight, a number of relevant incidences for each insight, a frequency of each insight, a user representation associated with each insight, a source of each insight, and a number of previously matched incidences for each insight.

12. The system of claim 10 , wherein the training outputs include a match between the incident and each of the plurality of insights.

13. The system of claim 10 , wherein each selected insight is a potential textual description of the incident.

14. The system of claim 10 , wherein the system is further configured to:

generate an enriched root cause of the incident based on the root cause and the selected at least one suitable insight.

15. The system of claim 10 , wherein the system is further configured to:

receive machine-generated textual data from at least one data source, wherein the machine-generated textual data is received from at least one machine in the monitored environment;

classify the received machine-generated textual data into at least one statistical metric;

process the at least one statistical metric to recognize a plurality of incidence patterns; and

correlate the plurality of incidence patterns to identify the root cause of the incident, wherein the incident occurred in the monitored environment.

16. The system of claim 15 , wherein the system is further configured to:

group the machine-generated textual data into a plurality of events;

process each event to determine a plurality of elements embedded therein;

determine a type of each of the plurality of elements; and

determine a statistical metric for each element based on at least the type of the element.

17. The system of claim 10 , wherein the machine-generated textual data includes at least one of: application logs, configuration files, alerts, sensory signals, audit records, and a combination thereof.