Root Cause Analysis with Alert Grouping based on Network Traffic

A non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising:

• obtaining a representation of an alert;
• identifying a host within a network that is associated with the alert;
• selecting, from a plurality of service maps defining services that are operable within the network, a service map including the host;
• identifying process-to-process connections between the host and each of one or more other hosts;
• and
• generating, based on the process-to-process connections, a group alert indicator characterizing respective relationships between the alert and alerts associated with the one or more other hosts.

A system comprising:

• one or more processors;
• and
• memory, containing program instructions that, upon execution by the one or more processors, cause the system to perform operations comprising:
• obtaining a representation of an alert;
• identifying a host within a network that is associated with the alert;
• selecting, from a plurality of service maps defining services that are operable within the network, a service map including the host;
• identifying process-to-process connections between the host and each of one or more other hosts;
• and
• generating, based on the process-to-process connections, a group alert indicator characterizing respective relationships between the alert and alerts associated with the one or more other hosts.