AIOps Helps Health Systems Tackle Alert Fatigue
Alert fatigue is another challenge to maintaining a self-aware network, and healthcare providers have no shortage of alerts. AIOps, or artificial intelligence for IT operations, allows healthcare organizations to prioritize important alerts, Lin explains.
“For example, embedding AI within observability tools can help to set alerts and reduce false positives by creating dynamic baselines using historic data,” he says, adding that health systems can then group alerts into events to maintain visibility and prioritize what to monitor first.
AIOps allow health systems to self-heal by using AI and machine learning to detect problems and resolve issues without disruptions occurring. In addition, AI agents such as log agents and metric agents can correlate and pull together information on network issues. Rather than humans being responsible for identifying the root cause of IT problems, ML technologies and large language models can now sort through data to find the issues in log files and self-diagnose, Lobig says.
RELATED: Splunk Enterprise brings end-to-end observability to data-rich environments.
Key Strategies for Maintaining Visibility and Security
To create a self-aware and secure IT network, organizations should adopt a “trust but verify” approach, Lin advises. (Zero trust, which follows a “never trust, always verify” approach, is an alternative to “trust but verify.”)
He recommends healthcare organizations have data-driven conversations with vendors as part of an observability center of excellence model. A CoE is a group that provides a framework for carrying out and maintaining observability. It helps with governance by explaining the rules and standards for observability, such as what to observe and how to observe. A CoE also provides guidance on which observability tools to use.
Open telemetry creates a unified framework for telemetry data as well as automation of processes, scripts and tools to improve operational efficiency and reduce downtime. It opens up data collection, which is often proprietary and difficult to manage, Lobig says. In addition, observability tools use telemetry to gain contextual information on where a problem originates on a network.
Lobig recommends using vulnerability management tools to allow organizations to distinguish the false positive alerts that pop up from the many scanning tools, dials and knobs, he says.
Configuration management databases provide visibility by allowing healthcare organizations to track which devices, such as medical carts, are attached to a network and know whether a device has been dormant for a long time.
Security teams (SecOps) and observability teams (ITOps) can use a unified platform to share data to detect incidents before they occur and to remediate threats faster. Detecting incidents earlier will allow health systems to be more resilient, Lin says.
