Identifying suggested actions for responding to incidents in an it environment

1. A computer-implemented method, comprising:

identifying, by an IT operations platform, an occurrence of a type of incident in an IT environment;

in response to identifying the occurrence of the type of incident, generating a workbook based on a customizable workbook template, wherein the customizable workbook template includes a plurality of tasks for remediating occurrences of the type of incident;

identifying, for a task of the plurality of tasks, one or more suggested executable actions for completing the task, wherein a suggested executable action of the one or more suggested executable actions is identified by correlating a name or description of the suggested executable action to a name or description of the task; and

causing display of a graphical user interface (GUI) including a representation of the workbook, wherein the representation of the workbook includes the one or more suggested executable actions.

2. The computer-implemented method of claim 1 , further comprising:

receiving input selecting the suggested executable action; and

executing, by the IT operations platform, the suggested executable action.

3. The computer-implemented method of claim 1 , further comprising:

receiving input selecting an executable action that is different from the one or more suggested executable actions;

executing, by the IT operations platform, the executable action;

generating log data indicating whether execution of the executable action was successful; and

evaluating the log data to determine whether to include, in the customizable workbook template, the executable action in the one or more suggested executable actions associated with the task.

4. The computer-implemented method of claim 1 , further comprising:

receiving input requesting to remove a suggested executable action from the one or more suggested executable actions for completing the task; and

removing the suggested executable action from the customizable workbook template.

5. The computer-implemented method of claim 1 , wherein identifying the occurrence of the type of incident in the IT environment comprises:

receiving an input from a data intake and query system indicating the occurrence of the type of incident in the IT environment.

6. The computer-implemented method of claim 1 , further comprising:

executing, by the IT operations platform, the suggested executable action;

generating log data indicating whether execution of the suggested executable action was successful; and

modifying an order of the one or more suggested executable actions based on the log data.

7. The computer-implemented method of claim 1 , wherein the type of incident is associated with a severity level, and wherein the method further comprises:

determining a designated amount of time to resolve the occurrence of the type of incident based on the severity level; and

sending a notification to a user account associated with a particular task of the plurality of tasks; and

initiating a timer for the designated amount of time.

8. The computer-implemented method of claim 1 , wherein the type of incident is associated with a severity level, and wherein the method further comprises:

determining a designated amount of time to resolve the occurrence of the type of incident based on the severity level;

sending a notification to a first user account associated with a particular task of the plurality of tasks;

initiating a timer for the designated amount of time; and

in response to an expiration of the timer prior to receiving a selection of an executable action from the first user account, designating a second user account for performance of the particular task.

9. The computer-implemented method of claim 1 , wherein the one or more suggested executable actions are displayed in the GUI in a prioritized order based on historical data, wherein the historical data includes characteristics of previous executions of the one or more suggested executable actions, and wherein the characteristics of the previous executions of the one or more suggested executable actions include one or more of: a result of the previous executions, frequency of use of each of the one or more suggested executable actions, or recency of use of each of the one or more suggested executable actions.

10. The computer-implemented method of claim 1 , wherein the plurality of tasks are grouped in two or more separate phases, wherein the GUI includes a representation of the two or more separate phases.

11. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

identifying, by an IT operations platform, an occurrence of a type of incident in an IT environment;

in response to identifying the occurrence of the type of incident, generating a workbook based on a customizable workbook template, wherein the customizable workbook template includes a plurality of tasks for remediating occurrences of the type of incident;

identifying, for a task of the plurality of tasks, one or more suggested executable actions for completing the task, wherein a suggested executable action of the one or more suggested executable actions is identified by correlating a name or description of the suggested executable action to a name or description of the task; and

causing display of a graphical user interface (GUI) including a representation of the workbook, wherein the representation of the workbook includes the one or more suggested executable actions.

12. The computing device of claim 11 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

receiving input selecting the suggested executable action; and

executing, by the IT operations platform, the suggested executable action.

13. The computing device of claim 11 , further comprising:

receiving input selecting an executable action that is different from the one or more suggested executable actions;

executing, by the IT operations platform, the executable action;

generating log data indicating whether execution of the executable action was successful; and

evaluating the log data to determine whether to include, in the customizable workbook template, the executable action in the one or more suggested executable actions associated with the task.

14. The computing device of claim 11 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

receiving input requesting to remove a suggested executable action from the one or more suggested executable actions for completing the task; and

removing the suggested executable action from the customizable workbook template.

15. The computing device of claim 11 , wherein identifying the occurrence of the type of incident in the IT environment comprises:

receiving an input from a data intake and query system indicating the occurrence of the type of incident in the IT environment.

16. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

identifying, by an IT operations platform, an occurrence of a type of incident in an IT environment;

in response to identifying the occurrence of the type of incident, generating a workbook based on a customizable workbook template, wherein the customizable workbook template includes a plurality of tasks for remediating occurrences of the type of incident;

identifying, for a task of the plurality of tasks, one or more suggested executable actions for completing the task, wherein a suggested executable action of the one or more suggested executable actions is identified by correlating a name or description of the suggested executable action to a name or description of the task; and

causing display of a graphical user interface (GUI) including a representation of the workbook, wherein the representation of the workbook includes the one or more suggested executable actions.

17. The non-transitory computer-readable medium of claim 16 , wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform operations including:

receiving input selecting the suggested executable action; and

executing, by the IT operations platform, the suggested executable action.

18. The non-transitory computer-readable medium of claim 16 , wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform operations including:

receiving input selecting an executable action that is different from the one or more suggested executable actions;

executing, by the IT operations platform, the executable action;

generating log data indicating whether execution of the executable action was successful; and

evaluating the log data to determine whether to include, in the customizable workbook template, the executable action in the one or more suggested executable actions associated with the task.

19. The non-transitory computer-readable medium of claim 16 , wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform operations including:

receiving input requesting to remove a suggested executable action from the one or more suggested executable actions for completing the task; and

removing the suggested executable action from the customizable workbook template.

20. The non-transitory computer-readable medium of claim 16 , wherein identifying the occurrence of the type of incident in the IT environment comprises:

receiving an input from a data intake and query system indicating the occurrence of the type of incident in the IT environment.