Alert management system and method of using alert context-based alert rules

Patent metadata

Field	Value
Publication number	US-11252013-B2
Application number	US-202017077189-A
Country	US
Kind code	B2
Filing date	Oct 22, 2020
Priority date	Mar 29, 2018
Publication date	Feb 15, 2022
Grant date	Feb 15, 2022

Abstract

An alert management system for a configuration management database (CMDB) platform includes a client instance configured to: apply a first filter of an alert rule to CMDB alerts to select a first alert based on context of the first alert and apply a second filter of the alert rule to the CMDB alerts to select a second alert based on context of the second alert, wherein the context of the first and second alerts includes details regarding the first and second alerts and associated configuration items (CIs). The client instance is also configured to: evaluate at least one condition of the alert rule using the context of the first and/or second alert; and in response to evaluating the at least one condition of the alert rule to be true, performing at least one action of the alert rule using the context of the first and/or second alert.

First claim

The invention claimed is:

1. A method, comprising:
receiving a request to create an alert rule;
receiving a first filter of the alert rule, wherein the first filter is configured to select a first alert based on a first context of the first alert, wherein the first context comprises first information regarding a configuration item (CI) that generated the first alert or a first associated CI;
receiving a second filter of the alert rule, wherein the second filter is configured to select a second alert based on a second context of the second alert, wherein the second context comprises second information regarding a configuration item (CI) that generated the second alert or a second associated CI;
receiving a condition of the alert rule, wherein the condition defines a comparison between a first portion of the first context of the first alert and a second portion of the second context of the second alert;
receiving an action of the alert rule, wherein the action is configured to be executed in response to the condition being satisfied;
generating the alert rule based on the first filter, the second filter, the condition, and the action; and
in response to the condition being satisfied, performing the action.

2. The method of claim 1 , comprising:
applying the first filter of the alert rule to an alert table to select the first alert;
applying the second filter of the alert rule to the alert table to select the second alert;
evaluating the condition of the alert rule by comparing the first portion of the first context of the first alert to the second portion of the second context of the second alert; and
in response to evaluating the condition of the alert rule as true, performing the action of the alert rule.

3. The method of claim 1 , wherein the action comprises instructions to send an email, create an incident, update the first alert, update the second alert, add the first alert to a hierarchy group or a peer-to-peer group relative to the second alert, or a combination thereof.

4. The method of claim 1 , comprising receiving the request to create the alert rule via a graphical user interface (GUI), wherein the GUI comprises a plurality of user interface elements configured to receive the first filter, the second filter, the condition, and the action of the alert rule.

5. The method of claim 1 , wherein the condition comprises a relationship comparison between the first portion of the first context of the first alert and the second portion of the second context of the second alert.

6. The method of claim 1 , wherein the condition comprises a time condition.

7. The method of claim 6 , wherein the time condition comprises a threshold time window corresponding to a time difference between a first time value in the first context of the first alert and a second time value in the second context of the second alert.

8. The method of claim 1 , wherein the first filter specifies a threshold value for comparison with a third portion of the first context of the first alert.

9. The method of claim 1 , wherein:
the first context comprises an alert severity of the first alert, an alert criticality of the first alert, an alert name of the first alert, an identity of the CI that generated the first alert, or a class of the CI that generated the first alert, or a combination thereof;
the second context comprises an alert severity of the second alert, an alert criticality of the second alert, an alert name of the second alert, an identity of the CI that generated the second alert, or a class of the CI that generated the second alert, or a combination thereof; or
both.

10. The method of claim 1 , wherein:
the first associated CI is associated with the first alert or the CI that generated the first alert; and
the second associated CI is associated with the second alert or the CI that generated the second alert.

11. The method of claim 1 , wherein the CI that generated the first alert and the CI that generated the second alert are the same.

12. A system, comprising:
one or more processors; and
non-transitory memory comprising instructions executable by the one or more processors, wherein the instructions comprise instructions to generate a graphical user interface (GUI), wherein the GUI is configured to:
receive a first filter of an alert rule, wherein the first filter is configured to select a first alert based on a first context of the first alert, wherein the first context comprises first information regarding a configuration item (CI) that generated the first alert or a first associated CI;
receive a second filter of the alert rule, wherein the second filter is configured to select a second alert based on a second context of the second alert, wherein the second context comprises second information regarding a configuration item (CI) that generated the second alert or a second associated CI;
receive a condition of the alert rule, wherein the condition defines a comparison between a first portion of the first context of the first alert and a second portion of the second context of the second alert;
receive an action of the alert rule, wherein the action is configured to be executed in response to the condition being satisfied;
generate the alert rule based on the first filter, the second filter, the condition, and the action; and
in response to the condition being satisfied, performing the action.

13. The system of claim 12 , wherein the instructions comprise instructions to:
apply the first filter of the alert rule to an alert table to select the first alert;
apply the second filter of the alert rule to the alert table to select the second alert;
evaluate the condition of the alert rule by comparing the first portion of the first context of the first alert to the second portion of the second context of the second alert; and
in response to evaluating the condition of the alert rule as true, perform the action of the alert rule.

14. The system of claim 12 , wherein the action comprises instructions of a workflow, wherein the instructions of the workflow are configured to send an email, create an incident, update the first alert, update the second alert, add the first alert to a hierarchy group or a peer-to-peer group relative to the second alert, or a combination thereof.

15. The system of claim 12 , comprising a communicatively coupled client device, wherein the client device is configured to display the GUI.

16. The system of claim 12 , wherein the condition comprises a relationship comparison or a temporal comparison between the first portion of the first context of the first alert and the second portion of the second context of the second alert.

17. A non-transitory, computer-readable medium storing instructions executable by a processor of a computing system, wherein the instructions comprise instructions to:
receive a request to create an alert rule;
receive a first filter of the alert rule, wherein the first filter is configured to select a first alert based on a first context of the first alert, wherein the first context comprises first information regarding a configuration item (CI) that generated the first alert or a first associated CI;
receive a second filter of the alert rule, wherein the second filter is configured to select a second alert based on a second context of the second alert, wherein the second context includes comprises second information regarding a configuration item (CI) that generated the second alert or a second associated CI;
receive a condition of the alert rule, wherein the condition defines:
a first condition associated with

Assignees

• Servicenow Inc

Inventors

• Makovsky Bnayahu
• Miron Dov

Classifications

• G06Q10/063

  Operations research, analysis or management · CPC title

• G06Q10/087

  Inventory or stock management, e.g. order filling, procurement or balancing against orders · CPC title

• G06Q10/103

  Workflow collaboration or project management · CPC title

• H04L41/0613

  based on the type or category of the network elements · CPC title

• G06Q10/10

  Office automation; Time management · CPC title