Intelligent Event Management

One or more non-transitory computer-readable media comprising instructions that, when executed by one or more hardware processors, cause performance of operations comprising:

• identifying a plurality of events detected by a system;
• applying a set of one or more compression policies to the plurality of events to compute a plurality of incidents, wherein two or more events in the plurality of events are represented by a single compressed incident in the plurality of incidents;
• displaying, on a Graphical User Interface (GUI), a first plurality of interface elements corresponding to the plurality of events;
• displaying, on the GUI, a second plurality of interface elements corresponding to the plurality of incidents;
• and
• displaying, on the GUI, a third plurality of interface elements that maps the plurality of events to the plurality of incidents, wherein the two or more events are mapped to the single compressed incident by a set of one or more interface elements in the third plurality of interface elements.

One or more non-transitory computer-readable media comprising instructions that, when executed by one or more hardware processors, cause performance of operations comprising:

• identifying a plurality of events detected by a system;
• applying a first set of one or more event processing mechanisms to the plurality of events to compute a first plurality of incidents, wherein the first set of one or more event processing mechanisms does not comprise a particular compression policy;
• applying a second set of one or more event processing mechanisms to the plurality of events to compute a second plurality of incidents, the second set of one or more event processing mechanisms comprising the particular compression policy, wherein two or more events in the plurality of events are compressed by the particular compression policy into a single incident in the second plurality of incidents;
• displaying, on a Graphical User Interface (GUI), a first plurality of interface elements corresponding to the first plurality of incidents;
• displaying, on the GUI, a second plurality of interface elements corresponding to the second plurality of incidents;
• and
• displaying, on the GUI, a third plurality of interface elements that map the first plurality of incidents to the second plurality of incidents, wherein the third plurality of interface elements correspond to the plurality of events.

A method comprising:

• identifying a plurality of events detected by a system;
• applying a set of one or more compression policies to the plurality of events to compute a plurality of incidents, wherein two or more events in the plurality of events are represented by a single compressed incident in the plurality of incidents;
• displaying, on a Graphical User Interface (GUI), a first plurality of interface elements corresponding to the plurality of events;
• displaying, on the GUI, a second plurality of interface elements corresponding to the plurality of incidents;
• and
• displaying, on the GUI, a third plurality of interface elements that maps the plurality of events to the plurality of incidents, wherein the two or more events are mapped to the single compressed incident by a set of one or more interface elements in the third plurality of interface elements;
• wherein the method is performed by at least one device including a hardware processor.