Patent ID: 8682705

Claim:
A computer-implemented method to facilitate event correlation, said method comprising: choosing, by a processor responsive to an occurrence of an event in an Information Technology (IT) environment, a containment region to be used to correlate information related to the event, the containment region comprising a defined structure that includes resources, relationships between the resources, and a formal expression of impact one resource can have on another resource and used to reflect a scope and impact of the event, and wherein the choosing comprises determining whether a new containment region is to be created and used as a chosen containment region to correlate the information related to the event or whether an already existing containment region is to be used as the chosen containment region, wherein the chosen containment region includes a reason for inclusion in the containment region table that indicates a reason a specific resource is under evaluation as potentially impacted, implicated or perpetrating by the event represented by the chosen containment region; executing a plurality of discrete phases of processing, in response to the occurrence of the event, the plurality of discrete phases comprising first occurrence of the event, time from first occurrence of the event to a time to start collecting state information, time to stop collecting the state information, time to formulate an action plan, projected time to end taking action, wherein responsive to executing one or more discrete phases of the plurality of discrete phases, a set of related information associated with the event is obtained and included in the chosen containment region; and dynamically adjusting a time interval associated with at least one discrete phase of the plurality of discrete phases used to include the set of related information in the chosen containment region, the dynamically adjusting being based on real-time status of the IT environment, said adjusting controlling an amount of time to correlate one or more other events to the event to obtain the set of related information, and wherein the adjusting the time interval to correlate the one or more other events to obtain the set of related information is based on an explicit goal of the IT environment; a time to gather one or more responses from one or more resources of the chosen containment region, the one or more resources responding to queries of state information of the one or more resources; and at least one of a new resource added to the chosen containment region, and a new event added to the chosen containment region.