# US 2018/0324062 A1 · Incident management for complex information technology platforms

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0324062 A1
- Document ID: US20180324062A1
- Status: Published application
- Kind: A1
- Application number: 15/589,093
- Filed: 2017-05-08
- Published: 2018-11-08
- Earliest claimed: 2017-05-08
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Xiao Ling Chen; Xue Feng Gao; Fei Li; Ren Yi Ruan; Qing Feng Zhang
- Web page: https://patentgrep.com/patent/US20180324062A1

## CPC

- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 41/0636: {based on a decision tree analysis}
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 41/12: Discovery or management of network topologies
- H04L 41/0686: Additional information in the notification, e.g. enhancement of specific meta-data
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system, method and program product for managing incidents in a complex IT environment. A system is described that includes: a discovery module that analyzes an IT infrastructure and generates a topology of components and users; a monitoring module that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems; a relationship manager that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident: correlates the incident with a root cause, and determines a responsible admin and set of impacted users based on the relationship maps; and an operation engine that notifies the responsible admin and set of impacted users of the incident.

## Claims

### Claim 1

An incident management system for a complex information technology (IT) infrastructure, comprising:
a discovery module that analyzes an IT infrastructure and generates a topology of components and users;
a monitoring module that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems;
a relationship manager that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident:
correlates the incident with a root cause, and
determines a responsible admin and set of impacted users based on the relationship maps; and
an operation engine that notifies the responsible admin and set of impacted users of the incident.

### Claim 2 (depends on 1)

The incident management system of claim 1, wherein the topology includes a user topology and at least one component topology, where the at least one component topology is selected from a group of a hardware topology, a software/services topology, and a network topology.

### Claim 3 (depends on 2)

The incident management system of claim 2, wherein the relationship maps include a mapping between users and components.

### Claim 4 (depends on 1)

The incident management system of claim 1, wherein the incident comprises one of a current loss of cloud services or a predicted loss of cloud services.

### Claim 5 (depends on 1)

The incident management system of claim 1, wherein the root cause is determined with a binary tree.

### Claim 6 (depends on 1)

The incident management system of claim 1, wherein the monitoring module updates the topology when a change in the infrastructure is detected.

### Claim 7 (depends on 1)

The incident management system of claim 1, wherein the pattern repository is updated after the incident is detected and root cause is determined.

### Claim 8

A computer program product stored on a computer readable storage medium, which when executed by a computing system, provides incident management for a complex information technology (IT) infrastructure, the program product comprising:
program code that analyzes an IT infrastructure and generates a topology of components and users;
program code that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems;
program code that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident:
correlates the incident with a root cause, and
determines a responsible admin and set of impacted users based on the relationship maps; and
program code that notifies the responsible admin and set of impacted users of the incident.

### Claim 9 (depends on 8)

The program product of claim 8, wherein the topology includes a user topology and at least one component topology, where the at least one component topology is selected from a group of a hardware topology, a software/services topology, and a network topology.

### Claim 10 (depends on 9)

The program product of claim 9, wherein the relationship maps include a mapping between users and components.

### Claim 11 (depends on 8)

The program product of claim 8, wherein the incident comprises one of a current loss of cloud services or a predicted loss of cloud services.

### Claim 12 (depends on 8)

The program product of claim 8, wherein the root cause is determined with a binary tree.

### Claim 13 (depends on 8)

The program product of claim 8, further comprising program code that updates the topology when a change in the infrastructure is detected.

### Claim 14 (depends on 8)

The program product of claim 8, wherein the pattern repository is updated after the incident is detected and root cause is determined.

### Claim 15

A computerized method that performs incident management for a complex information technology (IT) infrastructure, the method comprising:
analyzing an IT infrastructure and generating a topology of components and users;
comparing ongoing activities of the IT infrastructure with a pattern repository to identify potential problems;
generating relationship maps of components and users based on the topology;
determining whether an identified potential problem comprises an incident, and in response to detecting an incident:
correlating the incident with a root cause, and
determining a responsible admin and set of impacted users based on the relationship maps; and
notifying the responsible admin and set of impacted users of the incident.

### Claim 16 (depends on 15)

The method of claim 15, wherein the topology includes a user topology and at least one component topology, where the at least one component topology is selected from a group of a hardware topology, a software/services topology, and a network topology.

### Claim 17 (depends on 15)

The method of claim 15, wherein the relationship maps include a mapping between users and components.

### Claim 18 (depends on 15)

The method of claim 15, wherein the incident comprises one of a current loss of cloud services or a predicted loss of cloud services.

### Claim 19 (depends on 15)

The method of claim 15, wherein the root cause is determined with a binary tree.

### Claim 20 (depends on 15)

The method of claim 15, further comprising updating the topology when a change in the infrastructure is detected.