Simulating multiple paths of a course of action executed in an information technology environment

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

• identifying, by an advisement system coupled to an information technology (IT) environment, first incident data indicating an occurrence of an incident affecting a computing asset in the IT environment, wherein the incident is associated with an incident type;
• identifying a course of action used to respond to incidents associated with the incident type;
• generating second incident data representing a simulated incident, wherein the second incident data includes incident characteristics associated with the incident type;
• executing the course of action using the second incident data as input;
• identifying, during execution of the course of action, a step of the course of action that is followed by a plurality of independent paths within the course of action, wherein execution of the course of action proceeds to one independent path of the plurality of independent paths depending on a result obtained from the step of the course of action;
• generating a plurality of simulated results for the step of the course of action, wherein each simulated result of the plurality of simulated results causes execution of the course of action to proceed to a respective path of the plurality of independent paths;
• and
• using the plurality of simulated results for the step to allow execution of the course of action to proceed to each of the plurality of independent paths.

An apparatus, comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the apparatus to:
• identify, by an advisement system coupled to an information technology (IT) environment, first incident data indicating an occurrence of an incident affecting a computing asset in the IT environment, wherein the incident is associated with an incident type;
• identify a course of action used to respond to incidents associated with the incident type;
• generate second incident data representing a simulated incident, wherein the second incident data includes incident characteristics associated with the incident type;
• execute the course of action using the second incident data as input;
• identify, during execution of the course of action, a step of the course of action that is followed by a plurality of independent paths within the course of action, wherein execution of the course of action proceeds to one independent path of the plurality of independent paths depending on a result obtained from the step of the course of action;
• generate a plurality of simulated results for the step of the course of action, wherein each simulated result of the plurality of simulated results causes execution of the course of action to proceed to a respective path of the plurality of independent paths;
• and
• use the plurality of simulated results for the step to allow execution of the course of action to proceed to each of the plurality of independent paths.