Method and system for recommending runbooks for detected events

A method comprising:

• detecting an occurrence of an event to be remediated, the event corresponding to a target component;
• obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
• obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
• identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations;
• and
• based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
• wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
• determining at least one of (a) a percentage of components that is the same in the first topology data and the second topology data, or (b) a percentage of communication channels that is the same in the first topology data and the second topology data, meets a threshold percentage.

A system, comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
• detecting an occurrence of an event to be remediated, the event corresponding to a target component;
• obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
• obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
• identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations;
• and
• based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
• wherein determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion comprises:
• determining at least one of (a) a percentage of components that is the same in the first topology data and the second topology data, or (b) a percentage of communication channels that is the same in the first topology data and the second topology data, meets a threshold percentage.

A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors cause performance of operations comprising:

• detecting an occurrence of an event to be remediated, the event corresponding to a target component;
• obtaining first topology data indicating a first set of one or more topological relationships between the target component and a first set of one or more other components;
• obtaining second topology data indicating a second set of one or more topological relationships between a second component and a second set of one or more other components;
• identifying a runbook previously executed in relation to the second component, the runbook defining a list of independently executable operations;
• and
• based on determining the first set of one or more topological relationships and the second set of one or more topological relationships meet a similarity criterion, presenting the runbook as a recommendation for remediating the event,
• wherein the first set of one or more topological relationships includes being communicatively connected to the target component within a predefined degree of separation, the predefined degree of separation defined by a number of intervening components along a communications path between a particular component and the target component.