# US 9,521,035 B2 · Filtering non-actionable alerts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,035 B2 - Document ID: US9521035B2 - Status: Granted - Kind: B2 - Application number: 14/561,784 - Filed: 2014-12-05 - Published: 2016-06-09 - Granted: 2016-12-13 - Earliest claimed: 2014-12-05 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Sandip Ganguly; Sreenath Kizhakkedath Pudukudi; Marian Stanescu; Monica Catunda - Web page: https://patentgrep.com/patent/US9521035B2 ## CPC - H04L 41/06: Management of faults, events, alarms or notifications - H04L 41/0636: {based on a decision tree analysis} - H04L 41/064: {involving time analysis} - H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies} - H04L 41/0681: Configuration of triggering conditions - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Handling alerts in a system to reduce to the number of non-actionable alerts that are provided to an alert handling portion of the system. A method includes receiving an alert. The alert is an unstructured data alert. The method further includes comparing the alert to a plurality of known non-actionable alerts to determine a similarity of the alert to one or more of the known non-actionable alerts. The method further includes dispatching the alert based on the similarity of the alert to one or more of the known non-actionable alerts. ## Claims ### Claim 1 A method, implemented at a system that includes one or more processors, of handling alerts to reduce a number of non-actionable alerts that are provided to an alert handling portion of the system, the method comprising: receiving an alert, wherein the alert is an unstructured alert comprising unstructured data; comparing the alert to one or more of a plurality of known non-actionable alerts, to determine a similarity between the alert and at least one of the known non-actionable alerts, including calculating a similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert, the similarity distance indicating how different the unstructured data of the alert is from the data of the least one known non-actionable alert; and dispatching the alert based on the calculated similarity distance, including: based at least on the similarity distance being less than a predetermined threshold, adding the alert to the plurality of known non-actionable alerts; or based at least on the similarity distance being greater than a predetermined threshold, performing additional processing to determine that the alert is a non-actionable alert. ### Claim 2 (depends on 1) The method of claim 1, further comprising adding the alert to the plurality of known non-actionable alerts based on the additional processing. ### Claim 3 (depends on 1) The method of claim 1, wherein performing the additional processing to determine that the alert is a non-actionable alert comprises providing the alert to an appropriate handler. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of known non-actionable alerts is a dynamic set of alerts that roll through a predetermined time window. ### Claim 5 (depends on 1) The method of claim 1, wherein the alert is received and compared in substantially real time. ### Claim 6 (depends on 1) The method of claim 1, wherein dispatching the alert comprises grouping the alert in a group with sufficiently similar alerts according to predetermined similarity criteria and processing the group of alerts as a batch. ### Claim 7 (depends on 1) The method of claim 1, wherein calculating the similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert comprises calculating a Levingshtein distance between the unstructured data of the alert and data of the least one known non-actionable alert. ### Claim 8 A system, comprising: one or more processors; and one or more computer-readable media, wherein the one or more computer-readable media comprise computer-executable instructions that are executable by at least one of the one or more processors to cause the system to reduce a number of non-actionable alerts that are provided to an alert handling portion of the system, the computer-executable instructions including instructions that are executable to cause the system to: receive an alert, wherein the alert is an unstructured alert comprising unstructured data; compare the alert to one or more of a plurality of known non-actionable alerts, to determine a similarity between the alert and at least one of the known non-actionable alerts, including calculating a similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert, the similarity distance indicating how different the unstructured data of the alert is from the data of the least one known non-actionable alert; and dispatch the alert based on the calculated similarity distance, including: based at least on the similarity distance being less than a prepetermined threshold, adding the alert to the plurality of known non-actionable alerts; or based at least on the similarity distance being greater than a predetermined threshold, performing additional processing to determine that the alert is a non-actionable alert. ### Claim 9 (depends on 8) The system of claim 8, the computer-executable instructions also including instructions that are executable to cause the system to add the alert to the plurality of known non-actionable alerts based on the additional processing. ### Claim 10 (depends on 8) The system of claim 8, wherein performing the additional processing to determine that the alert is a non-actionable alert comprises providing the alert to an appropriate handler. ### Claim 11 (depends on 8) The system of claim 8, wherein the plurality of known non-actionable alerts is a dynamic set of alerts that roll through a predetermined time window. ### Claim 12 (depends on 8) The system of claim 8, wherein the alert is received and compared in substantially real time. ### Claim 13 (depends on 8) The system of claim 8, wherein dispatching the alert comprises grouping the alert in a group with sufficiently similar alerts according to predetermined similarity criteria and processing the group of alerts as a batch. ### Claim 14 (depends on 8) The system of claim 8, wherein calculating the similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert comprises calculating a Levingshtein distance between the unstructured data of the alert and data of the least one known non-actionable alert. ### Claim 15 A computer program product comprising one or more computer-readable media, wherein the one or more computer-readable media comprise computer-executable instructions that are executable by one or more processors to cause a system to reduce a number of non-actionable alerts that are provided to an alert handling portion of the system, the computer-executable instructions including instructions that are executable to cause the system to: receive an alert, wherein the alert is an unstructured alert comprising unstructured data; compare the alert to to one or more of a plurality of known non-actionable alerts, to determine a similarity between the alert and at least one of the known non-actionable alerts, including calculating a similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert, the similarity distance indicating how different the unstructured data of the alert is from the data of the least one known non-actionable alert; and dispatch the alert based on the calculated similarity distance, including: based at least on the similarity distance being less than a predetermined threshold, adding the alert to the plurality of known non-actionable alerts; or based at least on the similarity distance being greater than a predetermined threshold, performing additional processing to determine that the alert is a non-actionable alert. ### Claim 16 (depends on 15) The computer program product of claim 15, the computer-executable instructions also including instructions that are executable to cause the system add the alert to the plurality of known non-actionable alerts based on the additional processing. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein performing the additional processing to determine that the alert is a non-actionable alert comprises providing the alert to an appropriate handler. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the plurality of known non-actionable alerts is a dynamic set of alerts that roll through a predetermined time window. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein dispatching the alert comprises grouping the alert in a group with sufficiently similar alerts according to predetermined similarity criteria to allow the group of alerts to be processed as a batch. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein calculating the similarity distance between the unstructured data of the alert and data of the least one known non-actionable alert comprises calculating a Levingshtein distance between the unstructured data of the alert and data of the least one known non-actionable alert.