Aggregation based event identification
According to an example, aggregation based event identification may include aggregating each of a plurality of source events by an event type of event types that represent dusters of the source events and/or a host of a source event of the source events to generate a reduced number of the source events. Aggregation based event identification may further include analyzing a characteristic for each of the reduced number of the source events, and assigning, based on the analysis of the characteristic for each of the reduced number of the source events, a characteristic weight to each of the reduced number of the source events. Further, aggregation based event identification may include aggregating the characteristic weights for each of the reduced number of the source events to determine an aggregated event issue weight for each of the reduced number of the source events.
1. A method performed by a system comprising a hardware processor, comprising:
aggregating a plurality of source events by at least one of an event type of event types that represent clusters of the source events or a host of a source event of the source events to generate a reduced number of the source events;
analyzing a characteristic for each source event of the reduced number of the source events;
assigning, based on the analyzing of the characteristic for each source event of the reduced number of the source events, characteristic weights to each source event of the reduced number of the source events; and
aggregating the characteristic weights for each source event of the reduced number of the source events to determine an aggregated event issue weight for each source event of the reduced number of the source events.
2. The method of claim 1 , wherein the characteristic includes one or more of:
a priority characteristic;
an abnormal behavior characteristic; and
a tagged characteristic.
3. The method of claim 1 , wherein aggregating the plurality of source events by at least one of the event type or the host of the source event to generate the reduced number of the source events comprises:
grouping the plurality of source events into buckets of predetermined time intervals; and
based on the grouping, for each respective bucket of the buckets, aggregating source events in the respective bucket by at least one of the event type or the host to generate the reduced number of the source events.
4. The method of claim 1 , wherein the characteristic includes a priority characteristic, and analyzing the priority characteristic for each source event of the reduced number of the source events comprises:
determining the priority characteristic by evaluating
a severity related to an associated one of the reduced number of the source events, and
presence of a keyword in the associated one of the reduced number of the source events.
5. The method of claim 4 , wherein the severity related to the associated one of the reduced number of the source events includes a plurality of severity levels ranging from low severity to high severity.
6. The method of claim 1 , wherein the characteristic includes an abnormal behavior characteristic, and analyzing the abnormal behavior characteristic for each source event of the reduced number of the source events comprises:
determining the abnormal behavior characteristic by evaluating
a baseline behavior related to an associated one of the reduced number of the source events, and
determining whether a behavior of the associated one of the reduced number of the source events deviates from the baseline behavior.
7. The method of claim 6 , wherein the baseline behavior is based on the event type of the event types.
8. The method of claim 1 , wherein the characteristic includes a tagged characteristic, and analyzing the tagged characteristic for each source event of the reduced number of the source events comprises:
determining the tagged characteristic by evaluating whether an associated one of the reduced number of the source events is identified as being relevant or as being non-relevant.
9. The method of claim 1 , further comprising:
determining whether the aggregated event issue weight for a given source event of the reduced number of the source events exceeds an aggregated event issue weight threshold; and
in response to a determination that the aggregated event issue weight for the given source event exceeds the aggregated event issue weight threshold, identifying the given source event for which the aggregated event issue weight exceeds the aggregated event issue weight threshold as an event of interest.
10. The method of claim 1 , wherein the aggregating of the plurality of source events comprises aggregating the plurality of source events by the event types and hosts of the source events.
11. The method of claim 1 , wherein the assigning of the characteristic weights to a respective source event of the reduced number of the source events comprises:
assigning a priority characteristic weight to the respective source event, the priority characteristic weight based on weights of keywords in the respective source event, and
assigning a further characteristic weight to the respective source event, the further characteristic weight different from the priority characteristic weight, and
wherein the aggregating of the characteristic weights for the respective source event comprises aggregating the priority characteristic weight and the further characteristic weight.
12. The method of claim 11 , wherein the further characteristic weight comprises an abnormal behavior characteristic weight assigned to the respective source event based on evaluating the respective source event with respect to a baseline behavior.
13. The method of claim 11 , wherein the further characteristic weight comprises a tagged characteristic weight assigned to the respective source event based on a user-input priority assigned to the respective source event.
14. A system comprising:
a processor; and
a non-transitory storage medium storing machine readable instructions executable on the processor to:
aggregate a plurality of source events by an event type of event types that represent clusters of the source events and a variable to generate a reduced number of the source events;
analyze a plurality of characteristics for each source event of the reduced number of the source events;
assign, based on the analyzing, a plurality of characteristic weights to each source event of the reduced number of the source events;
aggregate the plurality of characteristic weights for each source event of the reduced number of the source events to determine an aggregated event issue weight for each source event of the reduced number of the source events; and
determine, based on the aggregated event issue weight for each source event of the reduced number of the source events, an event of interest.
15. The system of claim 14 , wherein a characteristic of the plurality of characteristics includes a priority characteristic, and wherein the machine readable instructions to analyze the plurality of characteristics for each source event of the reduced number of the source events comprise machine readable instructions to:
receive a keyword; and
determine the priority characteristic by evaluating:
a severity related to an associated one of the reduced number of the source events, and
presence of the received keyword in the associated one of the reduced number of the source events.
16. The system of claim 14 , wherein the plurality of characteristic weights assigned to a respective source event of the reduced number of the source events comprise:
a priority characteristic weight assigned to the respective source event, the priority characteristic weight based on weights of keywords in the respective source event, and
a further characteristic weight assigned to the respective source event, the further characteristic weight different from the priority characteristic weight,
wherein the aggregating of the plurality of characteristic weights for the respective source event comprises aggregating the priority characteristic weight and the further characteristic weight.
17. The system of claim 16 , wherein the further characteristic weight comprises an abnormal behavior characteristic weight assigned to the respective source event based on evaluating the respective source event with respect to a baseline behavior.
18. The system of claim 16 , wherein the further characteristic weight comprises a tagged characteristic weight assigned to the respective source event based on a user-input priority assigned to the respective source event.
19. A non-transitory computer readable medium comprising machine readable instructions that when executed, cause a system to:
aggregate a plurality of source events by an event type of event types that represent clusters of the source events and a variable to generate a reduced number of the source events;
analyze, for each source event of the reduced number of the source events, a priority characteristic, an abnormal behavior characteristic, and a tagged characteristic;
assign, based on the analyzing for each source event of the reduced number of the source events, a priority characteristic weight, an abnormal behavior characteristic weight, and a tagged characteristic weight to each source event of the reduced number of the source events;
aggregate the priority characteristic weight, the abnormal behavior characteristic weight, and the tagged characteristic weight assigned to each source event of the reduced number of the source events to determine an aggregated event issue weight for each source event of the reduced number of the source events.