Filtering non-actionable alerts
AssigneeMicrosoft Technology Licensing, LLC
InventorsSandip Ganguly, Sreenath Kizhakkedath Pudukudi, Marian Stanescu, Monica Catunda
Life of this patent
Estimating the term…
Abstract
Handling alerts in a system to reduce to the number of non-actionable alerts that are provided to an alert handling portion of the system. A method includes receiving an alert. The alert is an unstructured data alert. The method further includes comparing the alert to a plurality of known non-actionable alerts to determine a similarity of the alert to one or more of the known non-actionable alerts. The method further includes dispatching the alert based on the similarity of the alert to one or more of the known non-actionable alerts.
Claims20
A method, implemented at a system that includes one or more processors, of handling alerts to reduce a number of non-actionable alerts that are provided to an alert handling portion of the system, the method comprising:
- receiving an alert, wherein the alert is an unstructured alert comprising unstructured data;
- comparing the alert to one or more of a plurality of known non-actionable alerts, to determine a similarity between the alert and at least one of the known non-actionable alerts, including calculating a similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert, the similarity distance indicating how different the unstructured data of the alert is from the data of the least one known non-actionable alert;
- and
- dispatching the alert based on the calculated similarity distance, including:
- based at least on the similarity distance being less than a predetermined threshold, adding the alert to the plurality of known non-actionable alerts;
- or
- based at least on the similarity distance being greater than a predetermined threshold, performing additional processing to determine that the alert is a non-actionable alert.
A system, comprising:
- one or more processors;
- and
- one or more computer-readable media, wherein the one or more computer-readable media comprise computer-executable instructions that are executable by at least one of the one or more processors to cause the system to reduce a number of non-actionable alerts that are provided to an alert handling portion of the system, the computer-executable instructions including instructions that are executable to cause the system to:
- receive an alert, wherein the alert is an unstructured alert comprising unstructured data;
- compare the alert to one or more of a plurality of known non-actionable alerts, to determine a similarity between the alert and at least one of the known non-actionable alerts, including calculating a similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert, the similarity distance indicating how different the unstructured data of the alert is from the data of the least one known non-actionable alert;
- and
- dispatch the alert based on the calculated similarity distance, including:
- based at least on the similarity distance being less than a prepetermined threshold, adding the alert to the plurality of known non-actionable alerts;
- or
- based at least on the similarity distance being greater than a predetermined threshold, performing additional processing to determine that the alert is a non-actionable alert.
A computer program product comprising one or more computer-readable media, wherein the one or more computer-readable media comprise computer-executable instructions that are executable by one or more processors to cause a system to reduce a number of non-actionable alerts that are provided to an alert handling portion of the system, the computer-executable instructions including instructions that are executable to cause the system to:
- receive an alert, wherein the alert is an unstructured alert comprising unstructured data;
- compare the alert to to one or more of a plurality of known non-actionable alerts, to determine a similarity between the alert and at least one of the known non-actionable alerts, including calculating a similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert, the similarity distance indicating how different the unstructured data of the alert is from the data of the least one known non-actionable alert;
- and
- dispatch the alert based on the calculated similarity distance, including:
- based at least on the similarity distance being less than a predetermined threshold, adding the alert to the plurality of known non-actionable alerts;
- or
- based at least on the similarity distance being greater than a predetermined threshold, performing additional processing to determine that the alert is a non-actionable alert.
Dependencies are inferred from the claim text.