Cloud Management and AIOps
Hide about this portal


This is an IBM Automation portal for Cloud Management, Technology Cost Management, Network Automation and AIOps products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).

Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.

Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Under review
Workspace IBM Cloud Pak for AIOps
Created by Guest
Created on Oct 1, 2024

RELATED IDEAS

Train events to identify event anomalies

See this idea on ideas.ibm.com

Events are received continuously and have a corresponding/expected payload which is used to perform important backend processing, e.g. policies will trigger incident creation based on field values, events are grouped based on scope values settings, events are associated to topology resources based on their matchToken values. If  event data sources like a SCOM or Zabbix system will change the payload due to updates or config changes, the backend processing might stop to work. If the events would be trained, AiOps would know how typical events will look like (field value settings) and can detect anomalies if a value does change suddenly, a field becomes empty which is wasn't before or is completly missing in the payload. Detecting these kind of deviations are hard to be executed by an human being but AI can easily learn the "normal" event payload (baseline) and detect anomalies if events start to look different than before.

Idea priority Urgent
  • Guest
    Reply
    |     Apr 2, 2025

    I am confused about "learn normal event payloads (baseline)".
    I know we can learn metrics (which are time series data) with a baseline and detect anomalies when deviating from it, but I cannot match this on events. Events are not time series based, they come in asynchronously with not time series, so the MAD component would not be applicable (when adding a Gateway or connector for it to MAD). And I am not aware of any other training module learning these event anomalies You say, it "It's essential to distinguish between metrics and events" and I agree, this actually makes up my confusion. So how would we be able to detect "event anomalies" then?
    To be more clear, the event anomaly would be in case of the "payload format". As an example: normally a Zabbix would always send events with 5 fields set and an anomaly here would be, if this changes suddenly from 5 to 6 fields, or if field no. 3 always has a text string as content but now suddenly the field is empty (or including an integer values instead. But the standard payload format depends on the sender (source). For other senders like Instana, there are for example 10 (partially different) fields and those have no relationship to the Zabbix events at all. So this request is about learning how a common event payload of a sender looks like and if it changes suddenly (called as event anomaly here, maybe the term is not the right one and causing the confusion).
    Does this make sense or should be plan for a quick meeting to discuss it for clarification?

  • Guest
    Reply
    |     Mar 31, 2025

    I will get in touch with you directly for more context during this week. Thx Detlef

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.