Incident detection and management

1. A method for operating an incident detection system, the method comprising:

receiving a first issue report at an issue tracking system at a first time;

receiving a second issue report at the issue tracking system at a second time after the first time;

determining an interval between the first time and the second time;

selecting a field populated in both the first issue report and the second issue report;

extracting a first data item from the populated field of the first issue report;

extracting a second data item from the populated field of the second issue report;

determining a similarity between the first data item and the second data item;

in accordance with a determination that the interval is less than the threshold time interval and that the similarity exceeds a threshold similarity value, creating or incrementing a similar issue report count;

creating or updating a similar issue report rate based at least in part on the similar issue report count;

determining that the similar issue report rate exceeds a threshold rate, causing the incident detection system to provide an output indicating that a possible incident has been identified.

2. The method of claim 1 , wherein:

the output comprises updating a user interface of the issue tracking system to notify a user of the user interface that the possible incident has been identified; and

updating the user interface comprises generating a notification and rendering the notification within the user interface.

3. The method of claim 1 , wherein the output comprises updating a user interface of a helpdesk system to notify a user of the helpdesk system that the possible incident has been identified.

4. The method of claim 1 , wherein the output comprises a notification.

5. The method of claim 1 , wherein the populated field comprises an issue report title.

6. The method of claim 1 , wherein the populated field comprises an issue report description.

7. The method of claim 1 , wherein the output comprises a notification includes a link to open a helpdesk application.

8. The method of claim 1 , wherein the first data item and the second data item comprise a listing of keywords extracted from the populated field.

9. The method of claim 1 , wherein the populated field comprises one of:

a location of a reporting user;

a time of day;

a software used by the reporting user; or

a service referenced by the reporting user.

10. A method for operating an incident detection system, the method comprising:

receiving a series of issue reports within a threshold time period at an issue tracking system;

comparing content extracted from a common field of each received issue report to group each received issue among a set of similar issues;

creating or updating a similar issue report rate for each group;

creating or updating a priority designation for each group; and

determining that at least one similar issue report rate exceeds a threshold rate or that at least one priority designation exceeds a threshold priority, causing the incident detection system to provide an output indicating that a possible incident has been identified.

11. The method of claim 10 , wherein the common field comprises:

a location of a reporting user;

a time of day;

a software used by the reporting user; or

a service referenced by the reporting user.

12. The method of claim 10 , wherein the content comprises:

an issue report title; or

an issue report description.

13. The method of claim 10 , wherein the output comprises updating a user interface of the issue tracking system to notify a user of the issue tracking system that the possible incident has been identified.

14. The method of claim 10 , wherein the output comprises updating a user interface of a helpdesk system to notify a user of the helpdesk system that the possible incident has been identified.

15. The method of claim 10 , wherein the output comprises a notification.

16. The method of claim 15 , wherein the notification includes a link to open a helpdesk application.

17. An incident detection system comprising:

a memory; and

a processor coupled to the memory and configured to execute an executable instruction stored in the memory to:

determine an interval between a first time at which a first issue report is received at an issue tracking system and a second time at which a second issue report is received at the issue tracking system;

select a field populated in both the first issue report and the second issue report;

extract a first data item from the populated field of the first issue report;

extract a second data item from the populated field of the second issue report;

determine a similarity between the first data item and the second data item;

in accordance with a determination that the interval is less than a threshold time interval and that the similarity exceeds a threshold similarity value, create or increment a similar issue report count;

create or update a similar issue report rate based at least in part on the similar issue report count;

in accordance with a determination that the similar issue report rate exceeds a threshold rate, causing the incident detection system to provide an output indicating that a possible incident has been identified.

18. The incident detection system of claim 17 , comprising a graphical user interface comprising the output.

19. The incident detection system of claim 17 , wherein the populated field comprises:

an issue report title;

an issue reporter location;

an issue description; or

an issue type.

20. The incident detection system of claim 17 , wherein the output comprises a notification.