A device may receive antenna alert data associated with antennas of a plurality of base stations of a network, and may process the antenna alert data, with a correlation model, to generate a correlation heatmap matrix. The device may utilize a change point detection model to process the antenna alert data, associated with the correlation heatmap matrix, to determine change point metrics, and may calculate scores for the antenna alert data associated with the correlation heatmap matrix and the change point metrics. The device may perform one or more corrective actions based on the scores.

An example operation may include a method comprising one or more of receiving a heartbeat failure notification message when a VNFCI is in standby state, building, at a VNFCI, a next state request message with standby and heartbeat failure parameters, sending the next state request message to an EMS, retrieving, at the EMS, a peer VNFCI state when the next state request message is received, sending a next state response message to the VNFCI with active state when one or more of: a peer VNFCI admin state is not online, and when a peer VNFCI is not reachable when the peer VNFCI admin state is online, sending a next state response message with standby state when the peer operational state is active, and sending the next state response message with standby to the VNFCI when the request of current issues on resources associated with the VNFCI from the VNFM is received and there are critical issues at the EMS.

Example methods and systems for dynamic event processing for network diagnosis are described. In one example, a computer system may monitor a runtime flow of multiple packets to detect a set of multiple events associated with the runtime flow. The computer system may perform a first stage of event processing by matching the set of multiple events to a set of multiple signatures that includes a first signature and a second signature. The first signature may be associated with a first mapping rule that is fully satisfied by the set of multiple events. The second signature may be associated with a second mapping rule that is partially satisfied. During a second stage of event processing, the second signature is disregarded. In response to diagnosing an issue associated with the runtime flow, remediation action(s) may be performed.

A system and technique for correlating computing network events includes receiving a deployment request for a computing service and identify a deployment template corresponding to the requested computing service where the deployment template indicates resources needed for providing the computing service. Available resources are identified and targeted based on the deployment template. The targeted resources are deployed and the deployment template is associated in a memory with an identification of a resource set indicating each of the deployed resource elements. Responsive to receiving an event including a resource identifier, an event manager identifies the resource set having the deployed resource corresponding to the resource identifier and correlates the event with at least one other active event corresponding to the resource set.

The present disclosure describes methods, computer-readable media, and apparatuses supporting management and resolution of alarms of a communication network. In one example, management and resolution may include receiving a new alarm, determining an alarm resolution of the new alarm based on the new alarm and historical alarm information, and initiating an alarm resolution action for resolving the new alarm based on the alarm resolution of the new alarm. In one example, management and resolution may include maintaining historical alarm information for a set of historical alarms, receiving a new alarm, determining a set of similar alarms including one or more of the historical alarms similar to the new alarm, determining an alarm resolution for the new alarm based on the set of similar alarms similar to the new alarm, and initiating an alarm resolution action for resolving the new alarm based on the alarm resolution of the new alarm.

Problem Diagnosis Automation System (PDAS) automates the diagnosis of repetitive problems and the enforcement of preventive measures across a network. Automation assets across the network include Network Intent (NI) inside the no-code platform. A Network Intent Cluster (NIC) clones a NI across the network to create a group of NIs (member NIs) with the same design or logic. A subset of Member NIs can be executed according to user-defined conditions based on the member device, the member NI tags, or signature variables. A Triggered Automation Framework (TAF) matches the incoming API calls from a 3rd party system to current incidents and installs the automation (e.g., NI/NIC) to be triggered for each call. It may include: Integrated IT System defining the scope and data of the incoming API calls; Incident Type to match a call to an Incident; and Triggered Diagnosis to define what and how the NIC/NI is executed.

An information technology (IT) network includes configuration items (CIs) that may constantly change, where the CIs describe hardware components or software components that are configured to operate on the IT network. A system comprising a server can determine a change associated with a CI, send, to a configuration management database (CMDB), a message that updates the CMDB based on the determined change associated with the CI, determine, for the CI, a monitor configuration that describes one or more variables and corresponding one or more parameters with which the CI is to be monitored, and send the CI with the monitor configuration to a plurality of monitoring software tools operating on a plurality of servers, where each monitoring software tool is configured to monitor the CI based on the monitor configuration.

An apparatus comprises a processing device configured to identify a given one of one or more assets in an information technology infrastructure associated with a support indicator associated with a priority level, and to obtain information characterizing state transitions of the one or more assets. The processing device is also configured to determine, based at least in part on a current state of the given asset identified utilizing the obtained information, a probability of the given asset transitioning to each of a plurality of states and to select, based at least in part on the determined probabilities, one of the plurality of states as a predicted future state of the given asset utilizing conformal prediction. The processing device is further configured to modify the priority level of the support indicator associated with the given asset based at least in part on the predicted future state of the given asset.

Example methods and systems are provided for network diagnosis. One example method may comprise: detecting an egress packet and determining whether each of multiple network issues is detected for the egress packet or a datapath between a first virtualized computing instance and a second virtualized computing instance. The method may also comprise: generating network diagnosis code information specifying whether each of the multiple network issues is detected or not detected; generating an encapsulated packet by encapsulating the egress packet with an outer header that specifies the network diagnosis code information; and sending the encapsulated packet towards the second virtualized computing instance to cause a second computer system to perform one or more remediation actions based on the network diagnosis code information.

An example method of entity lifecycle management in a service monitoring system includes: receiving, by a software application of a service monitoring system, a policy definition specifying an entity lifecycle management policy, wherein the entity lifecycle management policy defines management rules for a plurality of entities in the network environment, wherein each entity of the plurality of entities is represented by one of: a device, an application, a service, or a user account; identifying, by applying the entity lifecycle management policy to a plurality of active entities, one or more candidate entities for retirement; identifying, as retired entities, at least a subset of the one or more candidate entities; and excluding the retired entities from the plurality of active entities, thus preventing the retired entities from interacting with other components of the service monitoring system.