Method and system for recommending runbooks for detected events
Techniques for selecting a runbook to recommend for remediating a detected event are disclosed. When a system detects an event, the system obtains metadata associated with the event. The metadata provides information about the event and a system topology of the system in which the event occurred. The system generates a recommendation for a runbook to remediate the event based on one or both of characteristics of the event and characteristics of the topology in which the event occurred. The system compares a system topology to system topologies associated with previously-executed runbooks. The system recommends one of the previously-executed runbooks to remediate a detected event based on determining that the topology associated with the previously-executed runbook is similar to the topology of the system in which the event occurred.
1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors cause performance of operations comprising:
detecting an occurrence of an event to be remediated, the event corresponding to a target component;
obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations; and
based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
determining at least one of (a) a percentage of components that is the same in the first topology data and the second topology data, or (b) a percentage of communication channels that is the same in the first topology data and the second topology data, meets a threshold percentage.
2. The non-transitory computer readable medium of claim 1 , wherein the first topology data and the second topology data are obtained responsive to:
presenting a runbook selection interface including functionality for selecting at least one of a plurality of runbooks for execution; and
selecting the event to be remediated.
3. The non-transitory computer readable medium of claim 1 , wherein the operations further comprise:
collecting metadata associated with the event,
wherein the first topology data is obtained based on the metadata associated with the event.
4. The non-transitory computer readable medium of claim 1 , wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
identifying a first set of components in the first topology data that have a particular topological relationship with the target component; and
determining that a second set of components in the second topology data has the same particular topological relationship with a particular component in the second topology data.
5. The non-transitory computer readable medium of claim 1 , wherein the first set of one or more topological relationships includes being communicatively connected to the target component within a predefined degree of separation, the predefined degree of separation defined by a number of intervening components along a communications path between a particular component and the target component.
6. The non-transitory computer readable medium of claim 1 , wherein the second topology data is obtained from a repository of a plurality of topologies, each topology comprising a plurality of components and connections among the plurality of components,
wherein each of the plurality of topologies is associated in the repository with at least one runbook previously executed in relation at least one component in a respective topology.
7. The non-transitory computer readable medium of claim 1 , wherein presenting the runbook as the recommendation for remediating the event is further based on:
identifying a particular event to which the runbook was previously applied to remediate the particular event; and
determining that the event associated with the first topology data and the particular event meet a threshold level of similarity to each other.
8. The non-transitory computer readable medium of claim 1 , wherein the runbook includes at least one user-generated data label specifying at least one topological relationship in the second set of one or more topological relationships.
9. A method comprising:
detecting an occurrence of an event to be remediated, the event corresponding to a target component;
obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations; and
based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
determining at least one of (a) a percentage of components that is the same in the first topology data and the second topology data, or (b) a percentage of communication channels that is the same in the first topology data and the second topology data, meets a threshold percentage.
10. The method of claim 9 , wherein the first topology data and the second topology data are obtained responsive to:
presenting a runbook selection interface including functionality for selecting at least one of a plurality of runbooks for execution; and
selecting the event to be remediated.
11. The method of claim 9 , wherein the operations further comprise:
collecting metadata associated with the event,
wherein the first topology data is obtained based on the metadata associated with the event.
12. The method of claim 9 , wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
identifying a first set of components in the first topology data that have a particular topological relationship with the target component; and
determining that a second set of components in the second topology data has the same particular topological relationship with a particular component in the second topology data.
13. The method of claim 9 , wherein the first set of one or more topological relationships includes being communicatively connected to the target component within a predefined degree of separation, the predefined degree of separation defined by a number of intervening components along a communications path between a particular component and the target component.
14. The method of claim 9 , wherein the second topology data is obtained from a repository of a plurality of topologies, each topology comprising a plurality of components and connections among the plurality of components,
wherein each of the plurality of topologies is associated in the repository with at least one runbook previously executed in relation at least one component in a respective topology.
15. The method of claim 9 , wherein presenting the runbook as the recommendation for remediating the event is further based on:
identifying a particular event to which the runbook was previously applied to remediate the particular event; and
determining that the event associated with the first topology data and the particular event meet a threshold level of similarity to each other.
16. The method of claim 9 , wherein the runbook includes at least one user-generated data label specifying at least one topological relationship in the second set of one or more topological relationships.
17. A system, comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
detecting an occurrence of an event to be remediated, the event corresponding to a target component;
obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations; and
based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
determining at least one of (a) a percentage of components that is the same in the first topology data and the second topology data, or (b) a percentage of communication channels that is the same in the first topology data and the second topology data, meets a threshold percentage.
18. The system of claim 17 , wherein the first topology data and the second topology data are obtained responsive to:
presenting a runbook selection interface including functionality for selecting at least one of a plurality of runbooks for execution; and
selecting the event to be remediated.
19. The system of claim 17 , wherein the operations further comprise:
collecting metadata associated with the event,
wherein the first topology data is obtained based on the metadata associated with the event.
20. The system of claim 17 , wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
identifying a first set of components in the first topology data that have a particular topological relationship with the target component; and
determining that a second set of components in the second topology data has the same particular topological relationship with a particular component in the second topology data.
21. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors cause performance of operations comprising:
detecting an occurrence of an event to be remediated, the event corresponding to a target component;
obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations; and
based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
wherein the first set of one or more topological relationships includes being communicatively connected to the target component within a predefined degree of separation, the predefined degree of separation defined by a number of intervening components along a communications path between a particular component and the target component.