Event Management and CMDB

Event management and CMDB integration form the foundation of AIOps by transforming high-volume raw signals into actionable, correlated incidents. CMDB topology and change event data are the two most critical inputs that separate intelligent alert correlation from naive time-window grouping.

Overview

From events to incidents

In a 500-service microservices environment, monitoring can emit tens of thousands of raw signals per hour. A structured taxonomy plus an intelligent correlation layer keeps engineers from drowning in noise.

Event — Any raw signal from any monitoring system: a metric threshold crossing, a log pattern match, a deployment completing, a failing health check, a topology change — Extremely high; most need no action
Alert — An event that passed severity and relevance rules and deserves human or automated attention — Filtered; this step is where most AIOps noise reduction happens
Incident — A group of related alerts that together are one customer-impacting problem needing coordinated response — Typically one war room, one postmortem, one impact timeline

Normal business hours, per hour — About 1,000 — About 100 — 1 to 5
Failure cascade — 10,000 — 500 — 1

CMDB as the correlation backbone

Without CMDB integration, correlation is purely temporal. With it, AIOps adds topological correlation: an alert on postgres-primary at 14:32 and one on auth-service at 14:35 are grouped because the service graph links them, even three minutes apart.

ServiceNow CMDB, Atlassian JSM CMDB, BMC Helix CMDB — Enterprise
AWS Config, GCP Asset Inventory — Lightweight cloud-native

> [!IMPORTANT] CMDB quality is the single biggest determinant of alert correlation quality. A stale CMDB with outdated dependency maps produces wrong groupings.

Change events: the most important RCA signal

The most actionable context in triage is what changed recently: deployments, feature flag toggles, configmap updates, ASG scale-out events and database schema migrations.

Without change events in the platform, deploy-caused incidents take roughly 3 times longer to diagnose, because engineers check CI/CD dashboards separately from the incident console.

Webhooks — ArgoCD — ServiceNow change events
Workflow steps — GitHub Actions — Datadog change tracking
Flag-change events — LaunchDarkly — PagerDuty change correlation
Apply hooks — Terraform — Custom change events in the ITSM platform

Enrichment

A raw "auth service error rate spiked" is minimally useful. Enriched with the owning team, on-call contact, SLA tier, deployments in the last 2 hours and the 3 most similar past incidents with their resolutions, triage becomes guided verification instead of open-ended investigation.

Correlation algorithms

Production correlation combines three dimensions, and the best tools weight them using operator feedback on past groupings.

Interview questions

Walk through the complete event-alert-incident taxonomy with realistic volume numbers for a 500-service production system.
Explain how CMDB topology improves alert correlation beyond temporal clustering. What happens when CMDB data is stale?
Describe the event enrichment pipeline from raw alert to fully enriched incident context.
How do production AIOps tools combine temporal, topological, and text similarity correlation? How is operator feedback used to improve groupings over time?