Techniques for representation eviction on a unified network topology for incident detection and response

Abstract

A system and method for evicting a resource from a unified network topology (UNT) of a computing environment, is disclosed. The method includes: generating a representation of a UNT for a network topology of a computing environment, the representation based on a unified data schema, wherein the unified data schema is mapped to a plurality of data schemas, each corresponding to a unique data source; receiving an event record at a first time, the event record including a resource identifier; updating in the UNT a representation corresponding to the resource based on extracted data from the event record at the first time; determining that a time period has lapsed from the first time which is greater than a threshold; detecting that a number of event records which include the resource identifier is less than a threshold value; and removing the representation of the resource from the unified network topology.

CPC Classifications