# US 12,761,996 B2 · Incident detection and management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,761,996 B2 - Document ID: US12761996B2 - Status: Granted - Kind: B2 - Application number: 18/948,339 - Filed: 2024-11-14 - Published: 2025-02-27 - Granted: 2026-10-13 - Earliest claimed: 2020-03-25 - Assignees: Atlassian Pty Ltd.; Atlassian US, Inc. - Applicants: Atlassian Pty Ltd.; Atlassian US, Inc. - Inventors: Matthew David Hunter; Matthew Craig Saxby; Michael David Howells - Web page: https://patentgrep.com/patent/US12761996B2 ## CPC - G06F 11/0769: {Readable error formats, e.g. cross-platform generic formats, human understandable formats} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for detecting and managing incidents are disclosed. In one embodiment, a method for detecting an incident includes receiving issue data created for an issue tracking system; analyzing the received issue data over a predetermined interval; determining whether a potential incident has occurred based on the analysis; upon determining that a potential incident has occurred, creating an incident management assistant program; identifying one or more relevant users to communicate an alert to; and communicating the alert to the identified relevant users, the alert including a pointer to the incident management program. ## Claims ### Claim 1 A computer-implemented method for managing a potential incident, the method comprising: receiving a first issue report and a second issue report within a predetermined time interval; extracting a first data item from the first issue report and a second data item from the second issue report; evaluating a similarity between the first data item and the second data item with respect to a threshold similarity value; in response to the similarity satisfying the threshold similarity value, updating a similar issue report rate; in accordance with the similar issue report rate satisfying a threshold similar issue report rate, generating an alert indicating a possible incident; causing the alert to be communicated to a user device, thereby causing display, on the user device, of a user interface displaying a list of active bugs and a selectable affordance to create a new bug entry based on at least the first data item and the second data item; and subsequent to receiving a user selection of the selectable affordance to create the new bug entry, causing creation of a record of the new bug entry at a bug tracking tool. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the method further comprises: evaluating one or more additional similarities between the first data item, the second data item, and one or more previous data items extracted from previous issue reports; and in response to the one or more additional similarities satisfying the threshold similarity value, updating the similar issue report rate. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the method further comprises: grouping the first issue report and the second issue report with at least one of the previous issue reports based on common populated fields shared between the first issue report, the second issue report, and the at least one previous issue report; generating a graphical summary based on the common populated fields; and causing display of the graphical summary with respect to the grouping. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the method further comprises: extracting one or more additional first data items from the first issue report; extracting one or more additional second data items from the second issue report; evaluating one or more additional similarities between the one or more additional first data items and the one or more additional second data items; and in response to at least one additional similarity of the one or more additional similarities satisfying the threshold similarity value, updating the similar issue report rate. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, the method comprising: analyzing the first data item and the second data item to identify an application indicated by the first issue report and the second issue report, and wherein: causing creation of the record of the new bug entry includes providing an identifier of the application to the bug tracking tool; and the new bug entry includes an indication of the application based on the identifier. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein: the first issue report and the second issue report each indicate a same geographic location; the threshold similar issue report rate is a dynamic threshold similar issue report rate; and the method further includes selecting the dynamic threshold similar issue report rate based on the same geographic location. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein: causing display of the user interface includes generating a graphical summary of at least the first issue report and the second issue report and having an indication of the same geographic location; and the graphical summary is displayed contemporaneously with the list of active bugs. ### Claim 8 A method for operating an incident detection system, the method comprising: identifying a first issue report and a second issue report received at the incident detection system within a predetermined threshold time period; evaluating a first property descriptor extracted from the first issue report and a second property descriptor extracted from the second issue report, with respect to a correlation criteria; in response to the correlation criteria satisfying a correlation threshold, generating an issue report property summary including a distribution of issue reports received within the predetermined time period having at least one of the first property descriptor and the second property descriptor; causing to be displayed, within a graphical user interface of a first user device communicably coupled to the incident detection system, a graphical summary generated using the issue report property summary; in response to a user input received via the graphical user interface of the first user device, causing an alert to be communicated to a second user device communicably coupled to the incident detection system; subsequent to receiving the user input, causing to be displayed, within the graphical user interface of the first user device, a list of active bugs and a selectable affordance to create a new bug entry using at least the first property descriptor and the second property descriptor; and subsequent to receiving a user selection of the selectable affordance to create the new bug entry, causing creation of a record of the new bug entry at a bug tracking tool. ### Claim 9 (depends on 8) The method of claim 8, wherein the method further comprises: subsequent to receiving a user selection of a particular active bug of the list of active bugs, causing display of a list of tickets associated with the particular active bug; and associating at least one of the first issue report and the second issue report with the particular active bug. ### Claim 10 (depends on 9) The method of claim 9, wherein the method further comprises: subsequent to causing display of the list of tickets, receiving a user-generated text via an interface field; and storing the user-generated text as a comment for at least one ticket of the list of tickets. ### Claim 11 (depends on 8) The method of claim 8, wherein the first property descriptor indicates at least one of: a location from which the first issue report originated; a time of day that the first issue report was created; or an application service associated with the first issue report. ### Claim 12 (depends on 8) The method of claim 8, wherein: the first property descriptor and the second property descriptor each comprise one or more respective keywords; and evaluating the first property descriptor and the second property descriptor includes determining whether a threshold number of the one or more respective keywords have appeared in previous issue reports received during the predetermined threshold time period. ### Claim 13 (depends on 8) The method of claim 8, wherein the method further includes: evaluating one or more additional respective property descriptors of the first issue report and the second issue report to obtain one or more additional issue report property summaries; and causing to be displayed, within the graphical user interface of the first user device, one or more additional graphical summaries corresponding to the one or more additional issue report property summaries. ### Claim 14 (depends on 8) The method of claim 8, wherein the method further comprises: prior to causing an alert to be communicated to the second user device, identifying a support staff based on a support staff availability schedule; and determining the second user device is associated with the support staff. ### Claim 15 An incident detection system comprising: a memory; and a processor coupled to the memory and configured to execute a set of executable instructions stored in the memory, which when executed perform operations configured to: receive a set of issue reports, each issue report of the set of issue reports having a respective timestamp; evaluating respective timestamps of two or more issue reports of the set of issue reports to determine that the two or more issue reports were received within a predetermined interval; extract respective issue descriptor data items from each of the two or more issue reports; compare two or more respective issue descriptor data items to determine that the two or more respective issue descriptor data items are within a threshold similarity; increment a similar issue report rate based on the determination that the two or more respective issue descriptor data items were within the threshold similarity; in response to the similar issue report rate satisfying a threshold rate, detect a potential incident occurrence; cause to be displayed, within a graphical user interface of a user device communicably coupled to the incident detection system, a potential incident notification; and in response to receiving, via a selectable affordance of the graphical user interface of the user device, a user input requesting a new bug entry be created with respect to the potential incident occurrence, causing the new bug entry to be created at a bug tracking tool communicably coupled to the incident detection system. ### Claim 16 (depends on 15) The incident detection system of claim 15, comprising: subsequent to detecting the potential incident occurrence, generating a graphical summary based on at least the two or more respective issue descriptor data items; and displaying, within the graphical user interface of the user device, the graphical summary. ### Claim 17 (depends on 15) The incident detection system of claim 15, wherein: the graphical user interface is a first graphical user interface; and subsequent to causing the new bug entry to be created at the bug tracking tool, the incident detection system causes display of a second graphical user interface displaying one or more graphical elements corresponding to issue reports associated with the potential incident occurrence. ### Claim 18 (depends on 15) The incident detection system of claim 15, wherein causing the new bug entry to be created at the bug tracking tool includes causing the new bug entry to indicate a particular software application associated with the potential incident occurrence. ### Claim 19 (depends on 18) The incident detection system of claim 18, wherein the threshold rate is a dynamic threshold rate selected based on at least one of: a time of day; a geographic location; or the particular software application. ### Claim 20 (depends on 19) The incident detection system of claim 19, wherein: the user device is associated with a particular user account; and causing the potential incident notification to be displayed includes: identifying a team responsible for potential incidents associated with the particular software application; and determining the particular user account based on an association of the particular user account with the team.