A processor may receive a new ticket from a ticket management system. The processor may classify, in response to receiving the new ticket, one or more metrics to complete the new ticket. The processor may generate a ticket-metric classification that includes a list of users. The processor may identify a question contained in a digital record of the new ticket. The processor may cluster one or more other tickets into metric levels based on information about the question contained in the digital record of the new ticket. The processor may train a metric model using a database of tickets comprising features extracted from information from the ticket management system. The processor may assign the new ticket to a specific user on the list of users.

A processor may receive a new ticket from a ticket management system. The processor may classify, in response to receiving the new ticket, one or more metrics to complete the new ticket. The processor may generate a ticket-metric classification that includes a list of users. The processor may identify a question contained in a digital record of the new ticket. The processor may cluster one or more other tickets into metric levels based on information about the question contained in the digital record of the new ticket. The processor may train a metric model using a database of tickets comprising features extracted from information from the ticket management system. The processor may assign the new ticket to a specific user on the list of users.

The disclosure herein describes predicting potential impact of issues reported in incident ticket data on infrastructure element. A ticket manager component includes an impact model utilizing machine learning to analyze real-time event and metric data with incident-related data to generate predicted impact data. The predicted impact data identifies potentially impacted infrastructure elements, such as, potentially impacted users, predicted infrastructure components impacted by the issue and/or an updated time-period associated with the issue. The ticket manager component creates labeled incident tickets by updating user-generated incident tickets with additional data generated by the impact model, including predicted impact data and/or additional details associated with the issue. The labeled incident tickets are provided back to the model as training data to further refine predictions generated by the model.

Aspects of the present invention disclose a method for automated incident prioritization in network monitoring systems. The method includes one or more processors determining historical sentiment impact scores for one or more incident parameters based at least in part on textual content of customer feedback and changes of a customer sentiment during a time period corresponding to one or more system incidents of the time period. The method further includes assigning a classification to the one or more system incidents, wherein the classification corresponds to the one or more incident parameters. The method further includes determining an active incident sentiment impact score for each of one or more active incidents. The method further includes applying the active incident sentiment impact scores as a factor to prioritize incident handling of the one or more active incidents.

A computer implemented method of network monitoring and control. The method includes receiving alerts related to monitored devices; automatically analyzing the received alerts to determine a forthcoming predicted alert related to a monitored device; and automatically performing at least one predefined action for the monitored device based on the predicted alert.

One exemplary aspect describes systems and methods for determining normal SLE behavior, determining when a SLE exhibits abnormal deterioration, and determining whether to take an action to mitigate what appears to be an indication of an abnormal SLE.

A method and device for estimating a number of distinct subscribers of a telecommunication network impacted by network issues include, for a plurality of N successive counting periods preceding a current time, steps of determining, for each counting period, an estimate of a number of different subscribers impacted by at least one network issue by implementing a probabilistic counter structure, and storing at least one elementary counter in association to said counting period, aggregating the elementary counters in a multi-level final counter structure, wherein each level of the final counter structure has an associated probabilistic counter structure, the aggregation comprising, for each elementary counter: computing, for at least one level of the multi-level final counter structure, an intersection between said elementary counter and the probabilistic counter structure associated to said level of the multi-level final counter structure, and updating the multi-level final counter structure based on the intersection computed.

Aspects of the present disclosure relate to incident routing in a cloud environment. In an example, cloud provider teams utilize a scout framework to build a team-specific scout based on that team's expertise. In examples, an incident is detected and a description is sent to each team-specific scout. Each team-specific scout uses the incident description and the scout specifications provided by the team to identify, access, and process monitoring data from cloud components relevant to the incident. Each team-specific scout utilizes one or more machine learning models to evaluate the monitoring data and generate an incident-classification prediction about whether the team is responsible for resolving the incident. In examples, a scout master receives predictions from each of the team-specific scouts and compares the predictions to determine to which team an incident should be routed.

A system described herein may provide a technique for selecting and configuring a capture component and a filtering and analysis component for traffic capture in a manner that suitably accounts for Service Level Agreements (“SLAs”) of traffic to be captured. A traffic capture request may indicate one or more SLAs and/or other attributes, and an orchestration system may identify a network function (such as a User Plane Function (“UPF”) of a wireless network) that handles traffic that includes the requested traffic and instantiate the capture component at a node that implements the network function. The orchestration system may select a node, from a cluster of nodes, that is able to filter and analyze the traffic in an expedient manner in accordance with SLA(s) associated with the requested traffic, and install the filtering and analysis component at the selected node.

The method for triage management includes obtaining, from multiple sources, activity logs including issues for triage; processing the activity logs using a decision tree configured to output category and priority score associated with each issue; and, for each issue, identifying the relevant resources to resolve the issue based on the category of the issue, the priority score, and attributes of the relevant resources including historical issue resolution data. The method also includes determining a triage activity based on availability of the relevant resources, categories of the issues, and the priority scores. The triage activity includes a sequence for resolving the issues. The method also includes scheduling call for a predetermined time duration based on the availability and the attributes of the relevant resources; and generating a report for the triage activity, including real time information related to the obtained activity logs, the sources, and the sequence of the issues.