Classifying telemetry data to identify and remediate issues
In some examples, a server may receive, from a computing device, data identifying an event that occurred on the computing device. The server may determine a plurality of features associated with the event, determine a distance between individual features of the plurality of features and individual centroids of a plurality of clusters, and determine that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters. The server may determine a classification of the event based on the particular cluster and determine that the classification is a remediable issue. Based on the classification, the server may select and perform a remediation action from a plurality of remediation actions.
1. A method comprising:
receiving, by one or more processors and from a computing device, data identifying an event that occurred on the computing device;
determining, by the one or more processors, a plurality of features associated with the event;
determining, by the one or more processors, a distance between individual features of the plurality of features and individual centroids of a plurality of clusters;
determining, by the one or more processors, that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters;
determining, by the one or more processors, a classification of the event based on the particular cluster;
determining, by the one or more processors, that the classification is a remediable issue;
selecting, by the one or more processors and based on the classification, a remediation action from a plurality of remediation actions; and
performing, by the one or more processors, the remediation action.
2. The method of claim 1 , wherein the event comprises:
a name of the computing device;
a description of the computing device;
a timestamp indicating when the event occurred; and
a description of the event.
3. The method of claim 2 , wherein the description of the event comprises at least one of an operating system crash, an install of a particular software application was initiated, the particular software application failed to install, the install of the particular software application was successful, a downloaded software application failed a security hash check, a downloaded firmware failed the security hash check, a heartbeat event, or a selection event.
4. The method of claim 1 , wherein the classification comprises one of a normal event, a security issue, a bug, or an anomaly.
5. The method of claim 4 , wherein the remediable issue comprises one of the security issue or the bug.
6. The method of claim 1 , wherein the remediation action comprises at least one of:
temporarily deactivating an application programming interface (API) key associated with the computing device; or
temporarily discarding an additional event received from the computing device.
7. The method of claim 1 , wherein the remediation action comprises at least one of:
sending a first remediation instruction to the computing device instructing the computing device to:
uninstall an application;
download a latest version of the application; and,
install the latest version of the application;
sending a second remediation instruction to the computing device instructing the computing device to:
download a latest version of firmware associated with component of the computing device; and,
install the latest version of the firmware; or
sending a third remediation instruction to the computing device instructing the computing device to:
download a latest version of a basic input output system (BIOS) of the computing device; and,
install the latest version of the BIOS.
8. A server comprising:
one or more processors; and
one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:
receiving, from a computing device, data identifying an event that occurred on the computing device;
determining a plurality of features associated with the event;
determining a distance between individual features of the plurality of features and individual centroids of a plurality of clusters;
determining that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters;
determining a classification of the event based on the particular cluster;
determining that the classification is a remediable issue;
selecting, based on the classification, a remediation action from a plurality of remediation actions; and
performing the remediation action.
9. The server of claim 8 , wherein the event comprises:
a name of the computing device;
a description of the computing device;
a timestamp indicating when the event occurred; and
a description of the event.
10. The server of claim 9 , wherein the description of the event comprises at least one of an operating system crash, an install of a particular software application was initiated, the particular software application failed to install, the install of the particular software application was successful, a downloaded software application failed a security hash check, a downloaded firmware failed the security hash check, a heartbeat event, or a selection event.
11. The server of claim 8 , wherein:
the classification comprises one of a normal event, a security issue, a bug, or an anomaly; and
the remediable issue comprises one of the security issue or the bug.
12. The server of claim 8 , wherein the remediation action comprises at least one of:
temporarily deactivating an application programming interface (API) key associated with the computing device; or
temporarily discarding an additional event received from the computing device.
13. The server of claim 8 , wherein the remediation action comprises at least one of:
sending a first remediation instruction to the computing device instructing the computing device to:
uninstall an application;
download a latest version of the application; and,
install the latest version of the application;
sending a second remediation instruction to the computing device instructing the computing device to:
download a latest version of firmware associated with component of the computing device; and,
install the latest version of the firmware; or
sending a third remediation instruction to the computing device instructing the computing device to:
download a latest version of a basic input output system (BIOS) of the computing device; and,
install the latest version of the BIOS.
14. One or more non-transitory computer readable media storing instructions executable by one or more processors to perform operations comprising:
receiving, from a computing device, data identifying an event that occurred on the computing device;
determining a plurality of features associated with the event;
determining a distance between individual features of the plurality of features and individual centroids of a plurality of clusters;
determining that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters;
determining a classification of the event based on the particular cluster;
determining that the classification is a remediable issue;
selecting, based on the classification, a remediation action from a plurality of remediation actions; and
performing the remediation action.
15. The one or more non-transitory computer readable media of claim 14 , wherein the event comprises:
a name of the computing device;
a description of the computing device;
a timestamp indicating when the event occurred; and
a description of the event.
16. The one or more non-transitory computer readable media of claim 14 , wherein the description of the event comprises at least one of an operating system crash, an install of a particular software application was initiated, the particular software application failed to install, the install of the particular software application was successful, a downloaded software application failed a security hash check, a downloaded firmware failed the security hash check, a heartbeat event, or a selection event.
17. The one or more non-transitory computer readable media of claim 14 , wherein:
the classification comprises one of a normal event, a security issue, a bug, or an anomaly.
18. The one or more non-transitory computer readable media of claim 17 , wherein:
the remediable issue comprises one of the security issue or the bug.
19. The one or more non-transitory computer readable media of claim 14 , wherein the remediation action comprises at least one of:
temporarily deactivating an application programming interface (API) key associated with the computing device; or
temporarily discarding an additional event received from the computing device.
20. The one or more non-transitory computer readable media of claim 14 , wherein the remediation action comprises at least one of:
sending a first remediation instruction to the computing device instructing the computing device to:
uninstall an application;
download a latest version of the application; and,
install the latest version of the application;
sending a second remediation instruction to the computing device instructing the computing device to:
download a latest version of firmware associated with component of the computing device; and,
install the latest version of the firmware; or
sending a third remediation instruction to the computing device instructing the computing device to:
download a latest version of a basic input output system (BIOS) of the computing device; and,
install the latest version of the BIOS.