Auto pause incident notification

1. A method for pausing alert notifications, comprising:

triggering an alert responsive to an event in a managed environment;

obtaining a normalized title from a title of the alert;

determining, using the normalized title, whether the alert is of a likely transient type,

wherein the alert is determined to be of the likely transient type using a rolling table such that the alert is identified as being of the likely transient type responsive to identifying that 1) a first number of most recently resolved alerts matching the normalized title is greater than a predetermined minimum number and 2) at least a predetermined second number of the most recently resolved alerts were of the likely transient type, and

wherein the predetermined minimum number is greater than the predetermined second number;

responsive to determining that the alert is the likely transient type, withholding transmission of notifications for the alert during a pause period; and

responsive to determining that the alert is unresolved after the pause period, transmitting a notification for the alert to a responder.

2. The method of claim 1 , wherein obtaining the normalized title from the title of the alert comprises:

replacing each identifier in the title with a respective representative token; and

replacing each number of a numeric string of the title with a first predefined character.

3. The method of claim 1 , wherein obtaining the normalized title from the title of the alert further comprises applying at least one of:

removing newlines from the title;

removing tab characters from the title;

converting the title to a single case; or

replacing at least some punctuation characters with a second predefined character.

4. The method of claim 1 , wherein the alert is determined to be of the likely transient type using a machine learning model that takes as input a vectorized normalized title derived from the normalized title.

5. A device, comprising:

a memory; and

a processor, the processor configured to execute instructions stored in the memory to:

obtain a normalized title for an alert;

determine, using the normalized title, whether the alert is likely transient, wherein the alert is determined to be likely transient using a rolling table such that the alert is identified as likely transient responsive to identifying that 1) a first number of most recently resolved alerts matching the normalized title is greater than a predetermined minimum number and 2) at least a predetermined second number of the most recently resolved alerts were identified as transient, and wherein the predetermined minimum number is greater than the predetermined second number;

responsive to determining that the alert is of a likely transient type, withhold performance of an action for a pause period; and

responsive to determining that the alert is unresolved after a lapse of the pause period, perform the action.

6. The device of claim 5 , wherein to obtain the normalized title for the alert comprises to:

replace each identifier in a title of the alert with a respective representative token; and

replace each number of a numeric string of the title with a first predefined character.

7. The device of claim 6 , wherein to obtain the normalized title for the alert further comprises to apply at least one of:

remove newlines from the title;

remove tab characters from the title;

convert the title to a single case; or

replace at least some punctuation characters with a second predefined character.

8. The device of claim 5 , wherein the alert is determined to be of the likely transient type using a machine learning model that takes as input a vectorized normalized title derived from the normalized title.

9. The device of claim 5 , wherein the action comprises to notify a responder of the alert.

10. A non-transitory computer readable medium storing instructions operable to cause a processor to perform operations comprising:

predicting, using a prediction model, whether a condition will resolve during a pause period,

wherein the condition is predicted to resolve during the pause period using a rolling table such that the condition is predicted to resolve during the pause period responsive to identifying that 1) a first number of most recently resolved conditions matching the condition is greater than a predetermined minimum number and 2) at least a predetermined second number of the most recently resolved conditions resolved within the pause period, and

wherein the predetermined minimum number is greater than the predetermined second number;

responsive to predicting that the condition will resolve during the pause period, pausing performing an action for the pause period; and

responsive to determining that the condition did not resolve in the pause period, performing the action.

11. The non-transitory computer readable medium of claim 10 , wherein the instructions further comprise instructions to:

responsive to a status change with respect to the condition, updating the prediction model.

12. The non-transitory computer readable medium of claim 10 , wherein the operations further comprise:

triggering an alert responsive to an event in a managed environment; and

obtaining a normalized title from a title of the alert, wherein the condition is based on the normalized title.

13. The non-transitory computer readable medium of claim 12 , wherein obtaining the normalized title from the title of the alert comprises:

replacing each number of a numeric string of the title with a first predefined character.

14. The non-transitory computer readable medium of claim 12 , wherein obtaining the normalized title from the title of the alert comprises:

replacing each identifier in the title with a respective representative token.

15. The non-transitory computer readable medium of claim 12 , wherein obtaining the normalized title from the title of the alert further comprises applying at least one of:

removing newlines from the title;

removing tab characters from the title;

converting the title to a single case; or

replacing at least some punctuation characters with a second predefined character.

16. The non-transitory computer readable medium of claim 12 , wherein performing the action comprises:

sending a notification of the alert to a human responder.