ZIF is an AIOps platform that helps organizations to transform their IT operations from a reactive to a proactive mode. There are various use cases that cater to the needs of IT operations. This guide helps IT operations team and business teams to gain insights on the features offered by ZIF.

ZIF is a big data platform that can stream real time data from various monitoring, ITSM, log management tools. Data ingested into the platform is aggregated and machine learning algorithms are run in real time, helping IT operations team to take data driven actions.

ZIF has bots that can auto heal incidents, based on the predictive analytics driven by machine learning algorithms.

Supervised & Unsupervised algorithms are used in the platform, on streaming data to generate analytics in real time.

Zero Incident Framework™ is an enterprise subscription based platform. Users can access the platform via browser or mobile apps.

Enterprises will be provided with a dedicated URL that can be accessed by the platform users. Subscribed enterprise users can register with their corporate email ID and receive an auto generated password to their registered email address or request the administrator of the platform to create an account to access the platform.

Authentication can also be done by connecting to enterprises SAML or LDAP services.

ZIF is a role-based access driven platform. Based on the access defined to the user by the administrator, the menus and features are available for the users.

Dashboard is designed to adapt to a user’s creativity. User can design the dashboard to tell a story about the floor operations or on the pro activeness of the team.

Multiple dashboards can be added by a users and auto rotate can be turned on, to swap the dashboards.

ZIF also offers predefined dashboard templates that are available for the user to select while creating a new dashboard.

Every insight that is derived from analytics & the data that is ingested into the platform, are displayed as widgets. There are two types of insights in ZIF – Business Insights & Operational Insights.

Business Insights are helpful for managers and above to have a holistic view of the landscape. Operational Insights are helpful for floor engineers to track their day-to-day activities.

Widgets can be positioned on the dashboard’s canvas as preferred by the user. Click and drag option of widget enhances user experience.

Each widget has a settings option; where the user chooses the filter to be applied on the data that is displayed on the widget. These settings are saved to a users profile.

New insights can be developed and deployed as widgets into the production environment of the platform with zero downtime.

This view is called the “Birds View” in the dashboard section. Where CXO’s get a full view of their IT landscape which maps business process > business services > applications > devices.

This view help users’ understand how their business processes are getting impacted due to device failures. There are two views on this page – Current View and the Predicted View.

The real time status of the enterprise is displayed in the Current View. The forecast impact of the enterprise is displayed in the Predicted View.

Auto discovery and mapping of the application to devices can be done by Discovery module of ZIF. Business process to application mapping will be done manually by business owners of the enterprise.

Key feature of an AIOps platform is to aggregate multiple data types from various data sources. ZIF ingests data into the platform in real time by integrating to various data sources. Refer Integration section to know more about various techniques used.

Zero Incident Framework™ provides a single pane view of all data that is aggregated from the IT landscape. This view increases operators productivity, as they get to see the insights across the landscape from one a single pane. As the data is streamed into the platform in real time, this aggregated view gives a snapshot of the current status of the infrastructure.

Alerts & logs generated from multiple monitoring tools, can be aggregated into ZIF and viewed on a single page. Retention period of data within the platform is defined by the organization’s business need.

A must-have requirement from an AIOps platform is event/alert correlation. Data aggregated from multiple external tools, are processed using the correlation engine. Correlation happens in real time and unsupervised machine learning algorithms are used in correlation.

Data from various sources are ingested into ZIF in real time either by push or pull mechanism. As the data is ingested, labelling algorithms are run on the data to label the data based on identifiers. The labelled data is passed through the correlation engine where unsupervised algorithms are run to mine the patterns from the labelled data. Sub-sequence mining algorithms help in identifying unique patterns from the data.

Unique patterns identified are clustered using clustering algorithms to form cases. Every case that is generated is marked by unique a case id. As part of the clustering process, seasonality are checked from the historical transactions to derive a higher accuracy on correlation.

Correlation done based on pattern recognition helps in eliminating the need of relational CMDB from enterprise. The accuracy of the correlation increases as pattern reoccur. Algorithms also have the capability to unlearn patterns based on the feedback that can be provided by actions taken on correlation.

Algorithms used being unsupervised, the patterns are learned by the platform with zero human intervention post implementation.

Correlated events/alerts are clustered as cases in ZIF. Operators analyze each case that is generated and takes appropriate actions as per the operating procedures.

Each correlation that is generated by the algorithm is identified by a unique ID called Case ID. Text “ZIF” is added as a prefix to the id, which helps operators track incidents created by ZIF.

Description of the case that is displayed next to the case id is the probable Root Cause for the identified correlation.

To View Suppression or Correlation use the toggle available in the settings menu on this screen. Toggling between these would enable the operations team to view cases created either from Suppression or Correlation.

To map the severity of alerts that are generated from 3rd party monitoring tools, navigate to Settings menu -> Platform Settings -> Severity Mapping.

After selecting the tool name from the drop-down, the tool severity will be populated and the respective ZIF severity can be mapped by the user.

Please Note – List of tools will be populated only if 3rd party tools have been integrated with ZIF using Universal Connector. Please click here to integrate 3rd party tools using the universal connector in ZIF.

Predictive analytics has been the unique feature of ZIF. Machine learning algorithms used in the Predictive analytics module of ZIF have been granted a patent in the USA. The module uses unsupervised machine learning algorithms to predict a potential failure or performance degradation in devices or applications.

Once the performance data of applications (transaction time details) or devices (CPU, Memory, Disk, Network) has been ingested into ZIF using the universal connector, the algorithms start to learn the pattern of the data and look for potential anomalies that can cause failures or performance degradations. If issues are predicted by ZIF the same are created as opportunity cards in the platform for operation teams to take action.

The prediction dashboard has 5 swimlanes where the cards are populated. Based on the estimated time to impact the opportunity cards gets generated in wither warning or critical swimlane (if the estimated time to impact is less than 60 mins, the cards are generated in warning swimlane and if they are greater or equate to 60 minutes, then they are generated in critical swimlane)

If engineers have acted on the predictions made by ZIF, then the cards are updated to processed swimlane and if the engineers have missed taking an action, then they become lost cards.

Clicking on each of the cards, the details of the predictions can be viewed by the operations team. These details will identify the root cause of the issue that is prone to happen with the time and date when the issue would happen.

The operations team resolves the issues predicted by ZIF manually by logging into the application or device or can trigger automation bots to resolve the issues.

A True Agentelss discovery component from ZIF, enables organizations to discover every single IP device and application available in an enterprise.

IT operations team will get a physical and logical topological view of the entire enterprise. Discovery from ZIF also does Application Dependency Mapping (ADDM). Upstream and downstream connected applications are listed in the topological view.

By enabling a few protocols in the enterprise, ZIF will be able to a seamless discovery.

To Start Discovery using ZIF:

Pre-requisite – All devices to be discovered in ZIF should be enabled with SNMP, SSH & WMI.

• Navigate to RawData -> Settings -> Configuration Settings page to capture the protocol credentials within ZIF. These credentials used when creating a discovery within ZIF.

To start creating discovery from ZIF navigate to RawData -> Settings -> Create discovery. While creating discoveries, users can select a specific location, IP range, and type of devices to be discovered. Users can also enable recursive and non-recursive discovery within ZIF.

After capturing all the details clicking on create discovery will initiate the discovery process within ZIF and the platform will start polling all the devices that are part of the discovery to gather the required information. Once the discovery is complete, the topological view will be displayed for the respective discovery that was run.

ZIF has an integrated automation module, which can resolve incidents in the IT process by automatically or manually triggering the bots.

Bots developed using any scripting language can be uploaded into ZIF and be re-used in workflows that can be created using ZIF. Workflow creator in ZIF is a low code component, that can be reused by the IT operations team.

Uploading bots to ZIF:

In the settings, option navigate to ZIF Bots tab. Click on upload bot and enter the details of the bot in the sliding window that pop-ups and then click on apply.

Once successfully uploaded the uploaded bot will be displayed in the bot details grid.

The below workflows are available in the platform that is used by the ITOps team. In the upcoming release, more workflows will be added to the platform.

Dynamic workflow creation component in ZIF is a low code component that helps operations team to develop their own workflows within ZIF. Also, the operations team can reuse the workflows that are available in ZIF, by making a few alterations to the configurations.

Connectivity credential details of the environment (devices & applications) can be stored in the Connections page of workflow. Below are the steps to manage the connection details:

Navigate to the “Admin -> Connections” menu to manage the connections for target servers & external systems

Search for specific connection by using defined “Conn Id” to update the connection & credential information

Click on the “Edit” button to place the record in editing mode

Click on the “Save” button to commit the changes

ZIF workflow also allows the operations team to manage the variables in the script. This can be done from the admin -> variables section. Below are the steps to configure variable:

Navigate to the “Admin -> Variables” menu to manage the configuration entries (Ex: Hostname, Server IP, Log File Path, etc.) required for remediation

Search for the variable by using defined “Key” to update the configuration entries

Click on the “Edit” button to place the record in editing mode

Click on the “Save” button to commit the changes

This workflow establishes a connection with the targeted Windows device and brings up the service that has been stopped.

Before triggering this workflow, make sure the connection details are captured in the connection settings as per the steps above.

Go to the workflow named “WinServiceRestart” and click on “Trigger Workflow” as given below in the screenshot

Place the following text in the input field of Trigger Workflow: WinServiceRestart and click on the “Trigger” button to initiate the workflow.

{“caseId”: “00000”, “caseDescription”:”TESTINGCritical – Service Running Status – Stopped||Service down||Stopped Windows Audio, “, “deviceName”: “10.0.22.176”}

This workflow connects to the target server (Linux device) to clean up the logs periodically.  Logfile rotation will compress the log files when the defined condition is met and remove old log files from the system after the archival process.

Before triggering this workflow, make sure the connection details are captured in the connection settings as per the steps above.

Navigate to the workflow named “Log File Rotation” and click on “Trigger Workflow” as given below in the screenshot

Log in to the respective device to validate the clean-up of log files

Configuration Section for Log File Rotation (Target Device & Source/Target Path) has to be set before triggering the workflow:

Go to the “Admin -> Variables” section to change the target device from the workflow screen

Click on the Edit icon for the record with a key named “LogRotationDevice” and click on “Save” to commit the changes for the updated target device

Repeat the steps to update entries for the key named “LogRotationScript” in Variables Section

ZIF checks correlated cases and based on the threshold values, a problem ticket will be created in the ITSM tool

Navigate to the workflow named “CreateAlertsProblemTicket” and click on “Trigger Workflow” as given below in the screenshot

Click on the “Trigger” button to initiate the remediation

Log in to the ITSM tool to check the details of the Alerts Problem Ticket

Configuration screen (Connection) to manage the ITSM tool

Navigate to the “Admin -> Connections” section to manage the credentials of ServiceNow

Search for the record with Conn Id named “service_now”

Click on “Save” to commit the changes

Configuration information to manage ITSM tools’ variable

Navigate to the “Admin -> Variables” menu to manage the configuration entries

(Ex: ServiceNowIncidentConfig) required for remediation

Search for the variable by using defined “ServiceNowIncidentConfig” to update the configuration entries

Click on the “Edit” button to place the record in editing mode

Click on the “Save” button to commit the changes

ZIF establishes a connection with the targeted Linux device and kill the top memory consuming process in Apache Server

Navigate to the workflow named “Apache_Process_Automation” and click on “Trigger Workflow” as given below in the screenshot

Trigger Workflow: Apache_Process_Automation and click on the “Trigger” button to initiate the remediation

Log in to the respective device and check the currently running processes of Apache Server after remediation

Configuration screen (Connection) to manage the windows device credential

Navigate to the “Admin -> Connections” section to manage the credentials of the Linux Server from the workflow screen

Search for the record with Conn Id named “SSH_Conn_ID”

Click on “Save” to commit the changes for the updated target device if required

Configuration Section for Apache Process Kill:

Navigate to the “Admin -> Variables” section to change the SSH_Host device from the workflow screen

Click on the Edit icon for the record with a key named “SSH_Host” and click on “Save” to commit the changes for the updated target device

Configuration Section for Apache Process Kill:

Navigate to the “Admin -> Variables” section to change the Process_Count_Threshold from the workflow screen

Click on the Edit icon for the record with the key named “Process_Count_Threshold” and click on “Save” to commit the changes for the updated target device

ZIF periodically reads the request for DL Management and performs actions accordingly through the Automation workflow

Navigate to the workflow named “DL_Automation” and click on “Trigger Workflow” as given below in the screenshot

Click on the “Trigger” button to initiate the remediation

Log in to the ServiceNow ticketing tool to check the details of the state & work notes updates

Configuration screen (Connection) to manage the zif_api_service

Navigate to the “Admin -> Connections” section to manage the credentials of zif_api_service from the workflow screen

Search for the record with Conn Id named “zif_api_service”

Click on “Save” to commit the changes for the updated target device if required

Configuration Section for DL Management:

Navigate to the “Admin -> Variables” section to change the Service_Task from the workflow screen

Click on the Edit icon for the record with the key named “Service_Task” and click on “Save” to commit the changes for the updated target device