Edwin AI Auto-clustering Models

An Edwin AI auto-clustering model uses machine learning to group related alerts into actionable insights. The model identifies patterns from historical alert data to determine which alerts are likely related, enabling faster and more accurate incident detection without manual configuration or deep domain expertise.

An auto-clustering model measures similarity between alerts in a shared feature space based on their context and co-occurrence patterns. This enables Edwin to do the following:

• Automatically group alerts into insights to reduce noise by consolidating related alerts into a single, actionable insight.
• Identify recurring patterns and detect repeated issues across systems and environments.
• Surface non-obvious relationships and reveal connections between alerts that would be difficult to identify using manual rules or naming conventions.

Auto-clustering Model Alert Relationship Logic

An auto-clustering model identifies alerts primarily using the following fields:

• Alert Name (datapoint and DataSource)
• Alert Object (Instance Name)

The model considers two or more alerts as related if they display one or both of the following:

• Frequent co-occurrence—Alerts that regularly occur together (for example, simultaneously or in close sequence) are likely part of the same underlying issue.
  For example, if Alert X and Alert Y often display within the same time window, the model identifies them as related.
• Shared context—Alerts frequently generated at the same time as other alerts are likely related.
  For example, if Alert A and Alert B both frequently occur with Alerts C, D, and E, the model identifies Alerts A and B as related.

By learning these patterns over time, the auto-clustering model identifies relationships that are not obvious from alert names or static rules alone.

Alerts are analyzed within a rolling timeframe to identify time-specific relationships. The model continuously learns which alerts often occur together within a fifteen minute timeframe and groups alerts with similar patterns into the same insight.

Requirements for Configuring an Auto-clustering Model

To create a new auto-clustering model, you must have access to create models in Edwin AI

Configuring an Auto-clustering Model

1. In Edwin AI, create a new model.
   For more information, see Edwin AI Model Creation.
2. Select the Auto Cluster model type.
   Include other models as needed, for example a string model that matches related applications.
3. Select Create to save the model.

Saving the model puts it into a ready state by default.