Patent ID: 11916929
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method performed by an information technology (IT) and security operations application, the method comprising:
receiving, from a data intake and query system, data indicating an occurrence of an incident in an IT environment, wherein the data is associated with a tenant identifier identifying a customer associated with the data;
generating an incident event based on the data, the incident event identifying an incident type for the incident; and
assigning the incident event to an analyst of a plurality of analysts associated with the customer identified by the tenant identifier, wherein the analyst is selected based at least in part on an efficiency measurement derived from historical remediation data for the analyst, wherein the historical remediation data indicates an amount of time taken by the analyst to resolve incidents of the incident type, wherein a resolved incident is an incident that has been closed, and wherein the efficiency measurement is further based at least in part on data indicating a number of times that the analyst incorrectly identified incident events as false positives or incorrectly identified incident events as true positives.