Machine learning based event monitoring

A computer program product comprising one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by one or more computer processors to cause the one or more computer processors to perform a method comprising:

• identifying rules for relating events from one or more datasets in an event monitoring system, such as, an information technology service management (ITSM) system;
• determining an event window having a set of related events within a particular time window, based, at least in part, on the rules, wherein determining the event window comprises:
• determining a candidate event window having a set of related events within a candidate time window, based, at least in part, on the rules;
• classifying the candidate event window as non-actionable by applying a machine learning based classification model to information pertaining to the candidate event window;
• and
• modifying the candidate event window to form the event window, wherein modifying the candidate event window to form the event window comprises expanding the candidate time window to include one or more additional related events;
• training the machine learning based classification model, wherein an input layer to the machine learning based classification model receives a three-dimensional (3D) matrix representation of the event window further comprising:
• classifying the event window as actionable by applying the machine learning based classification model to the information pertaining to the event window, the information pertaining to the event window originating from a plurality of data sources:
• determining whether the event window is actionable;
• and
• responsive to classifying the event window as actionable, wherein the event window is related to a security breach event or a non-compliant event, automatically creating, by the machine learning based classification model, an event ticket for the event window in the event monitoring system.

A computer system comprising:

• one or more computer processors;
• one or more computer readable storage media, wherein
• the one or more computer processors are structured, located, connected and/or programmed to execute program instructions collectively stored on the one or more computer readable storage media;
• and
• the program instructions, when executed by the one or more computer processors, cause the one or more computer processors to perform a method comprising:
• identifying rules for relating events from one or more datasets in an event monitoring system, such as, an information technology service management (ITSM) system;
• determining an event window having a set of related events within a particular time window, based, at least in part, on the rules, wherein determining the event window comprises:
• determining a candidate event window having a set of related events within a candidate time window, based, at least in part, on the rules;
• and
• classifying the candidate event window as non-actionable by applying a machine learning based classification model to information pertaining to the candidate event window;
• and
• modifying the candidate event window to form the event window, wherein modifying the candidate event window to form the event window comprises expanding the candidate time window to include one or more additional related events;
• training the machine learning based classification model, wherein an input layer to the machine learning based classification model receives a three-dimensional (3D) matrix representation of the event window further comprising:
• classifying the event window as actionable by applying the machine learning based classification model to the information pertaining to the event window, the information pertaining to the event window originating from a plurality of data sources;
• determining whether the event window is actionable;
• and
• responsive to classifying the event window as actionable, wherein the event window is related to a security breach event or a non-compliant event, automatically creating, by the machine learning based classification model, an event ticket for the event window in the event monitoring system.