Fighting the Fog of War: Automated Incident Detection for Cloud Systems
summary
Warden is an automated incident detector deployed in Azure IcM that ingests alerts from selected monitors, uses a balanced random forest over 3-hour sliding windows, and highlights related alerts via a group Shapley value–style interpretation. The team selects ~150 top monitors, trains weekly on the last 12 months, and evaluates on 18 months of data from 26 services (~72% of Azure incidents). Warden outperforms baselines, is faster than humans for ~68% of detected incidents, and achieves perfect alert-group alignment in about half of cases.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:30Background
- 1:10Alerts
- 2:36Incident Management
- 4:27Related Work
- 5:02Warden: Automated Incident Detection
- 6:31Alert Signal Selection
- 9:57Identifying the incident-indicating Signals
- 11:18Warden in Practice
- 11:57Experimentation
- 14:25Conclusions
related talks
17mHarnessing AI for Autonomous Threat Defense in Multi-Cloud Security
52mWhen to use what monitoring service
21mModernize your security operations with Azure Sentinel
51mManaging SIEM And SOAR using Azure Sentinel
48mMonitoring and Managing the Hybrid Infrastructure with Azure Monitor and Azure Automation.
33mModernize Your Security Operations With Azure Sentinel
27mWhat's Happening AMBA?
19mDefender XDR in the Real World: Measurable Risk Reduction