Patent ID: 8903923

Claim:
A method comprising: configuring at least one processor to perform functions comprising: receiving data associated with an event alert associated with a condition affecting an information technology system; determining whether the event alert is actionable or non-actionable, wherein the determination of whether the event alert is actionable or non-actionable is based on one or more predictive rules; and in response to determination that the event alert is non-actionable, imposing a first specified waiting time on the event alert and requiring that the first specified waiting time on the event alert elapse before further action is taken for the event alert; wherein a second specified waiting time is associated with each of the one or more predictive rules, and wherein the second specified waiting time associated with each of the one or more predictive rules is either the longest duration of one or more transient event alerts identified by the rule, or is determined at least in part by taking into account the distribution of one or more transient event alerts identified by the rule.