Automated identification of hardware and software components relevant to incident reports

Patent metadata

Field	Value
Publication number	US-11061890-B2
Application number	US-201816151865-A
Country	US
Kind code	B2
Filing date	Oct 4, 2018
Priority date	Oct 4, 2018
Publication date	Jul 13, 2021
Grant date	Jul 13, 2021

Abstract

An example embodiment relates to configuration items representing properties of one or more of computing devices or software applications deployed on a managed network. The example embodiment may involve a computing device: receiving an incident report to which no configuration item is linked; generating a feature vector for the report by applying a computational model to the incident report; comparing the feature vector to at least some of a set of feature vectors; based on the comparison, identifying a set of incident reports that are potentially related to the report, wherein members of the set of incident reports are each linked, in one or more databases, to one or more members of a set of configuration items; selecting a particular configuration item of the set of configuration items to link to the incident report; linking the particular configuration item to the incident report; and storing the link in the database(s).

First claim

What is claimed is:

1. A system disposed within a computational instance of a remote network management platform that is associated with a managed network, the system comprising:
one or more databases containing (i) incident reports, each linked to one or more configuration items associated with the managed network, wherein the one or more configuration items represent properties of one or more of computing devices or software applications deployed on the managed network, (ii) a set of feature vectors, each representing information contained in fields of a different one of the incident reports, and (iii) a computational model trained to generate the set of feature vectors from the incident reports; and
a computing device configured to:
receive an incident report to which no configuration item is linked;
generate a feature vector for the incident report by applying the computational model to the incident report, wherein the feature vector comprises a plurality of keys, each key having a respective value, wherein each key of the plurality of keys corresponds to a respective word of a plurality of words in the incident report, and wherein the respective value for each of the plurality of keys represents a number of occurrences of the respective word in the incident report;
compare the feature vector to at least some of the set of feature vectors stored in the one or more databases;
based on the comparison, identify a set of incident reports that are potentially related to the incident report, wherein members of the set of incident reports are each linked, in the one or more databases, to one or more members of a set of configuration items;
select a particular configuration item of the set of configuration items to link to the incident report, wherein the particular configuration item is selected from the set of configuration items based on the particular configuration item being linked to at least a threshold number of the set of incident reports determined to be most relevant to the incident report;
link the particular configuration item of the set of configuration items to the incident report; and
store, in the one or more databases, the link between the incident report and the particular configuration item.

2. The system of claim 1 , wherein receiving the incident report to which no configuration item is linked comprises:
generating and providing, for display on a graphical user interface, an incident report page for (i) displaying fields of the incident report and (ii) receiving values in at least one of the fields; and
receiving the values, wherein the values do not include a unique identifier of a configuration item.

3. The system of claim 1 , wherein receiving the incident report to which no configuration item is linked comprises:
requesting and receiving, from the one or more databases, the incident report to which no configuration item is linked.

4. The system of claim 1 , wherein comparing the feature vector to at least some of the set of feature vectors stored in the one or more databases comprises determining similarity values, each representing an extent of similarity between the feature vector and a different member of the set of feature vectors, and
wherein identifying the set of incident reports that are potentially related to the incident report comprises including, in the set of incident reports, members whose feature vectors each have at least a predetermined extent of similarity with the feature vector generated for the incident report.

5. The system of claim 1 , wherein the computing device is configured to periodically identify, and link configuration items to, incident reports from the one or more databases to which no configuration items are linked.

6. The system of claim 1 , wherein linking the particular configuration item of the set of configuration items to the incident report comprises automatically linking the particular configuration item of the set of configuration items to the incident report without receiving user input instructing the computing device to link the particular configuration item of the set of configuration items to the incident report.

7. The system of claim 1 , wherein selecting the particular configuration item of the set of configuration items to link to the incident report comprises:
generating and providing, for display on a graphical user interface, a page including a suggestion region for (i) displaying potentially relevant configuration items from the set of configuration items, and (ii) receiving selection of the particular configuration item from the set of configuration items.

8. The system of claim 1 , wherein the computing device is configured to:
generate and provide, for display on a graphical user interface, a page including the incident report and a region for prompting and receiving user input of attributes of a configuration item that is potentially relevant to the incident report; and
determine that at least some of the received attributes match attributes of an existing configuration item stored in a configuration management database (CMDB) disposed within the computational instance,
wherein selecting the particular configuration item of the set of configuration items to link to the incident report and linking the particular configuration item to the incident report comprises, in response to determining that at least some of the received attributes match attributes of the existing configuration item stored in the CMDB, either:
automatically linking the existing configuration item to the incident report, or
generating and providing for display, on the graphical user interface, a suggestion region for (i) displaying the existing configuration item and (ii) receiving selection of the existing configuration item to link to the incident report.

9. The system of claim 8 , wherein the received attributes include one or more of: an Internet Protocol (IP) address, a uniform resource locator (URL), a service name, or a domain name.

10. The system of claim 1 , wherein the computing device is configured to:
generate and provide, for display on a graphical user interface, a page including a popup window overlaid on the incident report, wherein the popup window is for displaying questions arranged in a decision tree structure, wherein the questions are tailored to elicit input of attributes of a configuration item to link to the incident report.

11. A method performed by a computing device disposed within a computational instance of a remote network management platform associated with a managed network, the method comprising:
receiving an incident report to which no configuration item is linked, wherein one or more databases are disposed within the computational instance, wherein the one or more databases contains (i) incident reports, each linked to one or more configuration items associated with the managed network, wherein the one or more configuration items represent properties of one or more of computing devices or software applications deployed on the managed network, (ii) a set of feature vectors, each representing information contained in fields of a different one of the incident reports, and (iii) a computational model trained to generate the set of feature vectors from the incident reports;
generating a feature vector for the incident report by applying the computational model to the incident report, wherein the feature vector comprises a plurality of keys, each key having a respective value, wherein each key of the plurality of keys corresponds to a respective word of a plurality of words in the incident report, and wherein the respective value for each of the plurality of keys represents a number of occurrences of

Assignees

• Servicenow Inc

Inventors

• Steuer Rotem
• Epshtein Tal

Classifications

• G06F16/2379 Primary

  Updates performed during online database operations; commit processing · CPC title

• G06Q10/20

  Administration of product repair or maintenance · CPC title

• G06F40/30

  Semantic analysis · CPC title

• G06F16/3347 Primary

  using vector based model · CPC title

• G06F40/174

  Form filling; Merging · CPC title