Patent ID: 8756301

Claim:
A system for automating runbook documentation for unknown events based on known events, the system comprising: one or more memory devices comprising: a policy data store operative to store policies created by a network administrator; an events data store operative to store known events; a knowledge base operative to store runbooks associated with known events within the events data store and return a runbook in response to a request for the runbook associated with a given, known event, the runbooks including one or more references to policies within the policy data store; a processing device operative to receive selections of the runbooks to execute for an unknown event, after determining that the unknown event is not stored within the events data store, provide execution results of the policies referenced by the selected runbooks for the unknown event, facilitate requests for re-evaluation of policies for the unknown event based on the execution results associate the unknown event with the selected runbook, and storing the association between the unknown event and the selected runbook in the knowledge base; and a policy engine operative to subsequently execute policies referenced by the runbooks associated with the events within the events data store for the unknown event based on the association of the unknown events with the selected runbooks.