Method and system for handling dynamic incidents

• US 8,874,159 B2
• Filed: 05/10/2007
• Issued: 10/28/2014
• Est. Priority Date: 05/10/2007
• Status: Active Grant

• Current Assignee: STA Group, LLC
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Shaffer, Shmuel, Nagesh, Kittur V.
• Primary Examiner(s): Pan, Yuwen
• Assistant Examiner(s): Tran, Paul P
• Application Number:
  US11/746,960
• Publication Number:
  US 20080280637A1
• Time in Patent Office: 2,728 Days
• Field of Search: 455/11.1, 455/414.1, 455/450, 455/515, 455/517, 455/518, 455/519, 455/520, 455/552, 455/556, 455/557, 455/575, 455/457, 455/509, 455/5, 455/57, 340/8.1, 340/540, 340/534, 370/70, 370/312, 370/340, 370/342, 370/345, 370/390, 370/484, 370/230, 370/254, 370/328, 379/158, 379/188, 706/47, 706/48, 726/11, 726/23, 726/25
• US Class Current: 455/519
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04Q 2213/13098 Mobile subscriber
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/13109 Initializing, personal profile
• CPC Class Codes: H04Q 2213/13288 Closed user groups, CUG
• CPC Class Codes: H04Q 2213/1337 Operator, emergency services
• CPC Class Codes: H04Q 2213/13389 LAN, internet
• CPC Class Codes: H04W 4/10 Push-to-Talk [PTT] or Push-On-Call services
• CPC Class Codes: H04W 76/45 for Push-to-Talk [PTT] or Push-to-Talk over cellular [PoC] services

Abstract

A method for handling dynamic incidents includes initiating a first policy in response to a first incident. The first policy comprises a plurality of actions to be performed in response to the first incident. The method also includes creating at least one virtual talk group comprising a plurality of endpoints of different communication networks communicating using a respective communication protocol. The method further includes monitoring a plurality of events via a plurality of sources. At least one source comprises an endpoint from the plurality of endpoints of the virtual talk group. The method additionally includes detecting a deviation event and storing information indicative of the deviation event.

Claims

1. A method for handling dynamic incidents, comprising:

initiating, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident;

creating, by a first processor, at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol;

monitoring a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the first plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group;

detecting a first deviation event in the monitored first plurality of events, the first deviation event comprising a first action not included in the first plurality of actions of the first policy;

storing information indicative of the first deviation event;

initiating, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident;

creating, by a second processor, at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

monitoring a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the second policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

detecting a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

comparing the second deviation event to the first deviation event;

generating, based on the comparison, a suggestion comprising at least one modification to the second policy;

receiving an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion; and

storing information indicative of the second deviation event.

2. The method of claim 1, wherein each of the first deviation event and the second deviation event comprises an unexpected event.

3. The method of claim 1, wherein the second deviation event is similar to the first deviation event.

4. The method of claim 1, further comprising modifying the first policy based on the first deviation event.

5. The method of claim 1, further comprising creating a third policy based on the first policy and the first deviation event.

6. The method of claim 1, further comprising:

receiving a post incident assessment request;

presenting a user with the first plurality of events that occurred during the first incident; and

receiving a modification request indicating that the first policy is to be modified based on the first deviation event or that a third policy is to be created based on the first policy and the first deviation event.

7. A system for handling dynamic incidents, comprising:

a first processor operable to;

initiate, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident; and

create at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol; and

a first interface coupled to the processor, the first interface operable to;

monitor a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group; and

detect a first deviation event in the monitored first plurality of events, the first deviation event comprising an action not included in the first plurality of actions of the first policy;

the first processor is further operable to store information indicative of the deviation event;

a second processor operable to;

initiate, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident; and

create at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

a second interface coupled to the second processor, the second interface operable to;

monitor a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the second policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

detect a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

compare the second deviation event to the first deviation event;

generate, based on the comparison, a suggestion comprising at least one modification to the second policy; and

receive an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion;

the second processor is further operable to store information indicative of the second deviation event.

8. The system of claim 7, wherein each of the first deviation event and the second deviation event comprises an unexpected event.

9. The system of claim 7, wherein the second deviation event is similar to the first deviation event.

10. The system of claim 7, wherein the processor is further operable to modify the first policy based on the first deviation event.

11. The system of claim 7, wherein the processor is further operable to create a third policy based on the first policy and the first deviation event.

12. The system of claim 7, wherein the interface is further operable to:

receive a post incident assessment request;

present a user with the first plurality of events that occurred during the first incident; and

receive a modification request indicating that the first policy is to be modified based on the deviation event or that a third policy is to be created based on the first policy and the deviation event.

13. A non-transitory, computer readable medium comprising logic, the logic comprising code operable, when executed by a processor, to:

initiate, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident;

create at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol;

monitor a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the first plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group;

detect a first deviation event in the monitored first plurality of events, the first deviation event comprising a first action not included in the first plurality of actions of the first policy;

store information indicative of the first deviation event;

initiate, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident;

create, by a second processor, at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

monitor a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the second policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

detect a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

compare the second deviation event to the first deviation event;

generate, based on the comparison, a suggestion comprising at least one modification to the second policy;

receive an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion; and

store information indicative of the second deviation event.

14. The medium of claim 13, wherein each of the first deviation event and the second deviation event comprises an unexpected event.

15. The medium of claim 13, wherein the second deviation event is similar to the first deviation event.

16. The medium of claim 13, wherein the code is further operable to modify the first policy based on the first deviation event.

17. The medium of claim 13, wherein the code is further operable to create a third policy based on the first policy and the first deviation event.

18. The medium of claim 13, wherein the code is further operable to:

receive a post incident assessment request;

present a user with the first plurality of events that occurred during the first incident; and

receive a modification request indicating that the first policy is to be modified based on the deviation event or that a third policy is to be created based on the first policy and the deviation event.

19. A system for handling dynamic incidents, comprising:

means for initiating, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident;

means for creating at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol;

means for monitoring a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the first plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group;

means for detecting a first deviation event in the monitored first plurality of events, the first deviation event comprising a first action not included in the first plurality of actions of the first policy;

means for storing information indicative of the first deviation event;

means for initiating, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident;

means for creating at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

means for monitoring a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the first policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

means for detecting a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

means for comparing the second deviation event to the first deviation event;

means for generating, based on the comparison, a suggestion comprising at least one modification to the second policy;

means for receiving an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion; and

means for storing information indicative of the second deviation event.