Alert generation and augmentation using a large language model (‘LLM’)
Methods, systems, and products for alert generation and augmentation using a large language model (‘LLM’), including: providing, to the LLM, information describing a monitored deployment; providing, to the LLM, information describing one or more alerts associated with the monitored deployment; and receiving, from the LLM, an enhanced alert, wherein the enhanced alert is based at least in part on at least one of the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment.
1 . A method for alert generation and augmentation using a large language model (‘LLM’), the method comprising:
providing, to the LLM, information describing a monitored deployment;
providing, to the LLM, information describing one or more alerts associated with the monitored deployment; and
receiving, from the LLM, an enhanced alert, wherein the enhanced alert is based at least in part on both the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment, wherein the enhanced alert is augmented, by the LLM, with additional information.
2 . The method of claim 1 wherein the enhanced alert has been validated, based on the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment, by the LLM.
3 . The method of claim 1 wherein the enhanced alert includes information retrieved by the LLM in response to receiving at least one of the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment.
4 . The method of claim 1 further comprising receiving, from the LLM, an alert heuristic describing quantifiable aspects associated with the monitored deployment which, when detected, should trigger the generation of an alert.
5 . The method of claim 1 further comprising receiving feedback for an alert of a cloud deployment.
6 . The method of claim 5 further comprising initiating, based on the feedback, a workflow for modifying an alert heuristic.
7 . The method of claim 5 further comprising modifying, based on the feedback, an alert template associated with the alert.
8 . The method of claim 1 , wherein the information describing the monitored deployment comprises at least one member of the group consisting of:
infrastructure as code (IAC) templates used to provision resources;
external IP addresses accessed by resources;
code commits for software resources deployed within the monitored deployment; and
user modifications to resources within the monitored deployment.
9 . The method of claim 1 , wherein the information describing one or more alerts associated with the monitored deployment comprises at least one member of the group consisting of:
the alerts themselves;
heuristics used in detecting an event or condition that triggered the alert;
state of one or more resources in the monitored deployment that triggered the alert; and
activity detected in the monitored deployment that triggered the alert.
10 . A non-transitory computer readable storage medium storing instructions which, when executed, cause a processing device to:
provide, to an LLM, information describing a monitored deployment;
provide, to the LLM, information describing one or more alerts associated with the monitored deployment; and
receive, from the LLM, an enhanced alert, wherein the enhanced alert is based at least in part on both of the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment, wherein the enhanced alert is augmented, by the LLM, with additional information.
11 . The non-transitory computer readable storage medium of claim 10 wherein the enhanced alert has been validated, based on the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment, by the LLM.
12 . The non-transitory computer readable storage medium of claim 10 wherein the enhanced alert includes information retrieved by the LLM in response to receiving at least one of the information describing the monitored deployment and the information describing one or more alerts associated with the monitored deployment.
13 . The non-transitory computer readable storage medium of claim 10 further storing instructions which, when executed, cause the processing device to receive, from the LLM, an alert heuristic describing quantifiable aspects associated with the monitored deployment which, when detected, should trigger the generation of an alert.
14 . The non-transitory computer readable storage medium of claim 13 further storing instructions which, when executed, cause the processing device to initiate, based on the feedback, a workflow for modifying an alert heuristic.
15 . The non-transitory computer readable storage medium of claim 13 further storing instructions which, when executed, cause the processing device to modify, based on the feedback, an alert template associated with the alert.
16 . The non-transitory computer readable storage medium of claim 13 further storing instructions which, when executed, cause the processing device to generate a polygraph.
17 . The non-transitory computer readable storage medium of claim 10 , wherein the information describing the monitored deployment comprises at least one member of the group consisting of:
infrastructure as code (IAC) templates used to provision resources;
external IP addresses accessed by resources;
code commits for software resources deployed within the monitored deployment; and
user modifications to resources within the monitored deployment.
18 . The non-transitory computer readable storage medium of claim 10 , wherein the information describing one or more alerts associated with the monitored deployment comprises at least one member of the group consisting of:
the alerts themselves;
heuristics used in detecting an event or condition that triggered the alert;
state of one or more resources in the monitored deployment that triggered the alert; and
activity detected in the monitored deployment that triggered the alert.