Incident handling assistance based on previous incident handling

1. A method for improving incident handling in an information technology (IT) environment, the method comprising:

identifying, by an incident handling system, an incident in the IT environment;

identifying, by searching incident handling information stored by the incident handling system, one or more previous incidents identified by the incident handling system and that are similar to the incident, wherein the incident handling information indicates one or more courses of action executed by the incident handling system to respond to the one or more previous incidents, and wherein a course of action of the one or more courses of action includes a defined set of actions that are executable by the incident handling system;

selecting, from the one or more courses of action, a set of actions;

generating a suggested course of action using a defined ordering of the set of actions; and

executing, by the incident handling system, the suggested course of action in the IT environment.

2. The method of claim 1 , further comprising:

causing display of a notification of the incident.

3. The method of claim 1 , further comprising:

receiving input indicating a change to the suggested course of action; and

updating the suggested course of action based on the input.

4. The method of claim 1 , further comprising:

receiving input indicating a change to the suggested course of action, wherein the change comprises one or more of adding one or more actions into the suggested course of action, deleting one or more actions from the suggested course of action, or defining an undefined decision point within the suggested course of action; and

updating the suggested course of action based on the input.

5. The method of claim 1 , further comprising:

storing the suggested course of action for use with a future incident similar to the incident.

6. The method of claim 1 , further comprising:

storing the suggested course of action for use with a future incident similar to the incident; and

responsive to identifying the future incident, automatically executing the suggested course of action.

7. One or more computer readable storage media having program instructions stored thereon for improving incident handling in an information technology (IT) environment, the program instructions, when read and executed by a processing system, direct the processing system to:

identify, by an incident handling system, an incident in the IT environment;

identify, by searching incident handling information stored by the incident handling system, one or more previous incidents identified by the incident handling system and that are similar to the incident, wherein the incident handling information indicates one or more courses of action executed by the incident handling system to respond to the one or more previous incidents, and wherein a course of action of the one or more courses of action includes a defined set of actions that are executable by the incident handling system;

selecting, from the one or more courses of action, a set of actions;

generate a suggested course of action using a defined ordering of the set of actions; and

execute, by the incident handling system, the suggested course of action in the IT environment.

8. The one or more computer readable storage media of claim 7 , wherein the program instructions further direct the processing system to:

causing display of a notification of the incident.

9. The one or more computer readable storage media of claim 7 , wherein the program instructions further direct the processing system to:

receive input indicating a change to the suggested course of action; and

updating the suggested course of action based on the input.

10. The one or more computer readable storage media of claim 7 , wherein the program instructions further direct the processing system to:

receive input indicating a change to the suggested course of action;

wherein the change comprises one or more of adding one or more actions into the suggested course of action, deleting one or more actions from the suggested course of action, and defining an undefined decision point within the suggested course of action; and

updating the suggested course of action based on the input.

11. The one or more computer readable storage media of claim 7 , wherein the program instructions further direct the processing system to:

store the suggested course of action for use with a future incident similar to the incident.

12. The one or more computer readable storage media of claim 11 , wherein the program instructions further direct the processing system to:

store the suggested course of action for use with a future incident similar to the incident; and

responsive to identifying the future incident, automatically execute the suggested course of action.

13. An apparatus for improving incident handling in an information technology (IT) environment, the apparatus comprising:

one or more computer readable storage media;

a processing system operatively coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:

identify, by an incident handling system, a first incident in the IT environment;

identify, by searching incident handling information stored by the incident handling system, one or more previous incidents identified by the incident handling system and that are similar to the incident, wherein the incident handling information indicates one or more courses of action executed by the incident handling system to respond to the one or more previous incidents, and wherein a course of action of the one or more courses of action includes a defined set of actions that are executable by the incident handling system;

selecting, from the one or more courses of action, a set of actions;

generate a suggested course of action using a defined ordering of the set of actions; and

execute, by the incident handling system, the suggested course of action in the IT environment.

14. The apparatus of claim 13 , wherein the program instructions further direct the processing system to:

receive input indicating a change to the suggested course of action;

wherein the change comprises one or more of adding one or more actions into the suggested course of action, deleting one or more actions from the suggested course of action, and defining an undefined decision point within the suggested course of action; and

update the suggested course of action based on the input.

15. The method of claim 1 , wherein the suggested course of action is generated by adding at least one action from the defined set of actions to the suggested course of action, wherein the suggested course of action includes a plurality of actions including the at least one action, and wherein the at least one action is associated with a defined execution sequencing.

16. The method of claim 1 , wherein selecting an action of the set of actions includes:

identifying an action that occurs in at least a threshold percentage of the one or more courses of action; and

adding the action to the suggested course of action.

17. The method of claim 1 , wherein selecting an action of the set of actions includes:

identifying an action that was used in at least a threshold percentage of successful courses of action of the one or more courses of action; and

adding the action to the suggested course of action.

18. The method of claim 1 , further comprising:

receiving input indicating a change to an execution order associated with the suggested course of action; and

updating the suggested course of action based on the input.

19. The method of claim 1 , further comprising causing display of a block flow diagram representing the course of action.

20. The method of claim 1 , further comprising:

causing display of a block flow diagram representing the course of action;

receiving input indicating a modification to the block flow diagram representing the course of action; and

updating the suggested course of action based on the input.

21. The one or more computer readable storage media of claim 7 , wherein the suggested course of action is generated by adding at least one action from the defined set of actions to the suggested course of action, wherein the suggested course of action includes a plurality of actions including the at least one action, and wherein the at least one action is associated with a defined execution sequencing.

22. The one or more computer readable storage media of claim 7 , wherein selecting an action of the set of actions includes:

identifying an action that occurs in at least a threshold percentage of the one or more courses of action; and

adding the action to the suggested course of action.

23. The one or more computer readable storage media of claim 7 , wherein selecting an action of the set of actions includes:

identifying an action that was used in at least a threshold percentage of successful courses of action of the one or more courses of action; and

adding the action to the suggested course of action.

24. The one or more computer readable storage media of claim 7 , wherein the program instructions further direct the processing system to:

receive input indicating a change to an execution order associated with the suggested course of action; and

update the suggested course of action based on the input.

25. The one or more computer readable storage media of claim 7 , wherein the program instructions further direct the processing system to cause display of a block flow diagram representing the course of action.

26. The one or more computer readable storage media of claim 7 , further comprising:

causing display of a block flow diagram representing the course of action;

receiving input indicating a modification to the block flow diagram representing the course of action; and

updating the suggested course of action based on the input.

27. The apparatus of claim 13 , wherein the suggested course of action is generated by adding at least one action from the defined set of actions to the suggested course of action, wherein the suggested course of action includes a plurality of actions including the at least one action, and wherein the at least one action is associated with a defined execution sequencing.

28. The apparatus of claim 13 , wherein selecting an action of the set of actions includes:

identifying an action that occurs in at least a threshold percentage of the one or more courses of action; and

adding the action to the suggested course of action.

29. The apparatus of claim 13 , wherein selecting an action of the set of actions includes:

identifying an action that was used in at least a threshold percentage of successful courses of action of the one or more courses of action; and

adding the action to the suggested course of action.

30. The apparatus of claim 13 , wherein the program instructions further direct the processing system to:

receive input indicating a change to an execution order associated with the suggested course of action; and

update the suggested course of action based on the input.