Automatic remediation of non-compliance events

Abstract

A system and method for automatic remediation of non-compliance events are provided. In embodiments, a computer-implemented method includes: accessing a compliance profile and a remediation profile, wherein the compliance profile includes compliance data regarding rules for an enterprise and the remediation profile includes remediation data regarding remediation actions to address non-compliance with one or more of the rules; generating mapped data by mapping compliance data in the compliance profile to remediation data in the remediation profile; receiving non-compliance event data from a workload node in a network; extracting information from the non-compliance event data including the workload node associated with the event and a cause of event; determining a remediation action for the event based on the information and the mapped data; and invoking automatic performance of the remediation action at the workload node based on the determined remediation action.

What is claimed is: 
     
         1 . A method, comprising:
 automatically generating, by a computing device, a compliance profile from text-based documents;   automatically generating, by the computing device, a remediation profile from the text-based documents;   automatically iteratively updating, by the computing device, the compliance profile and the remediation profile using natural language processing in response to receiving new versions of the text-based documents, thereby generating updated compliance profiles and updated remediation profiles;   automatically iteratively updating, by the computing device, mapped data utilizing metadata in the updated compliance profiles, thereby generating mapped data that is platform agnostic for use across multiple software platforms;   receiving, by the computing device, real-time non-compliance event data from one of a plurality of remote workload nodes in a cloud network, the real-time non-compliance event data being associated with an event at the one of the plurality of remote workload nodes where an action was non-compliant with one or more of the rules;   storing, by the computing device, the real-time non-compliance event data for the event in a queue with other non-compliance event data from other events, wherein the event and the other events are prioritized based on predetermined rules; and   invoking, by the computing device, automatic performance of a remediation action at the one of the plurality of remote workload nodes based on the mapped data and prioritized events in the queue.   
     
     
         2 . The method of  claim 1 , further comprising iteratively invoking, by the computing device, a performance of subsequent remediation actions until an indication is received that compliance with the one or more rules has been met at the one of the plurality of remote workload nodes. 
     
     
         3 . The method of  claim 1 , further comprising receiving, by the computing device, a status notification of non-compliance or compliance of the one or more of the rules subsequent to invoking the automatic performance of the remediation action. 
     
     
         4 . The method of  claim 3 , wherein the status notification is a status notification of non-compliance. 
     
     
         5 . The method of  claim 3 , further comprising saving, by the computing device, the non-compliance event data in a data store with the status notification, thereby generating an event tracking log. 
     
     
         6 . The method of  claim 1 , further comprising extracting, by the computing device, information from the real-time non-compliance event data including information identifying the one of the plurality of remote workload nodes associated with the event and a cause of the event. 
     
     
         7 . The method of  claim 6 , wherein the extracting the information from the real-time non-compliance event data comprises:
 parsing the real-time non-compliance event data using additional natural language processing, thereby generated parsed data;   extracting the one of the plurality of remote workload nodes associated with the event from the parsed data; and   extracting the cause of the non-compliance from the parsed data.   
     
     
         8 . The method of  claim 1 , wherein the computing device retrieves the real-time non-compliance event data from the one of a plurality of remote workload nodes via a secure shell (SSH) network protocol. 
     
     
         9 . The method of  claim 1 , wherein the mapping includes mapping to platforms, services and rules in compliance data of the respective updated compliance profiles to matching platforms, services and rules in remediation data of the respective updated remediation profiles. 
     
     
         10 . A computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:
 automatically generate a compliance profile and a remediation profile from text-based documents;   automatically iteratively update the compliance profile and the remediation profile using natural language processing in response to receiving new versions of the text-based documents, thereby generating updated compliance profiles and updated remediation profiles;   automatically iteratively update mapped data utilizing metadata in the updated compliance profiles to map platforms, services and rules in compliance data of the respective updated compliance profiles to matching platforms, services and rules in remediation data in the respective updated remediation profiles, thereby generating mapped data that is platform agnostic for use across multiple software platforms;   receive real-time non-compliance event data from one of a plurality of remote workload nodes in a cloud network, wherein the real-time non-compliance event data is associated with an event at the one of the plurality of remote workload nodes where an action was non-compliant with one or more of the rules;   store the real-time non-compliance event data for the event in a queue with other non-compliance event data from other events, wherein the event and the other events are prioritized based on predetermined rules; and   invoke automatic performance of a remediation action at the one of the plurality of remote workload nodes based on the mapped data and prioritized events in the queue.   
     
     
         11 . The computer program product of  claim 10 , wherein the program instructions are further executable to iteratively invoke a performance of subsequent remediation actions until an indication is received that compliance with the one or more rules has been met at the one of the plurality of remote workload nodes. 
     
     
         12 . The computer program product of  claim 10 , wherein the program instructions are further executable to receive a status notification of non-compliance or compliance of the one or more of the rules subsequent to invoking the automatic performance of the remediation action. And wherein the program instructions are further executable to save the real-time non-compliance event data in a data store with the status notification, thereby generating an event tracking log. 
     
     
         13 . The computer program product of  claim 10 , wherein the program instructions are further executable to extract information from the real-time non-compliance event data including information identifying the one of the plurality of remote workload nodes associated with the event and a cause of the event. 
     
     
         14 . The computer program product of  claim 13 , wherein the extracting the information from the real-time non-compliance event data comprises: parsing the real-time non-compliance event data using additional natural language processing, thereby generating parsed data; extracting the one of the plurality of remote workload nodes associated with the event from the parsed data; and extracting the cause of the non-compliance from the parsed data. 
     
     
         15 . A system comprising:
 a processor, a computer readable memory, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:
 generate a compliance profile and a remediation profile from text-based documents; 
 automatically iteratively update the compliance profile and the remediation profile using natural language processing in response to receiving new text-based documents, thereby generating updated compliance profiles and updated remediation profiles; 
 automatically iteratively update mapped data utilizing metadata in the updated compliance profiles to map platforms, services and rules in compliance data of the respective updated compliance profiles to matching platforms, services and rules in remediation data in the respective updated remediation profiles, thereby generating mapped data; 
 receive real-time non-compliance event data from one of a plurality of remote workload nodes in a cloud network, wherein the real-time non-compliance event data is associated with an event at the one of a plurality of remote workload nodes where an action was non-compliant with one or more of the rules; 
 store the real-time non-compliance event data for the event in a queue with other non-compliance event data from other events, wherein the event and the other events are prioritized based on predetermined rules; and 
 invoke automatic performance of a remediation action at the one of the plurality of remote workload nodes based on the mapped data and prioritized events in the queue. 
   
     
     
         16 . The system of  claim 15 , wherein the generating the compliance profile and the remediation profile utilizes natural language processing and semantic analysis, and comprises: utilizing the natural language processing to generate natural language processing data in the form of structured insights and feeding the natural language process data to a semantic analysis module for the semantic analysis based on predetermined rules, thereby producing a semantic tree as an output of the semantic analysis module, wherein the compliance profile and the remediation profile are generated based on the semantic tree. 
     
     
         17 . The system of  claim 15 , wherein the program instructions are further executable to:
 receive a status notification indicating whether the remediation action successfully addressed the non-compliance; and   invoke performance of a subsequent remediation action at the one of the plurality of remote workload nodes based on the status notification to address the non-compliance, wherein the invoking the performance of the remediation action is performed iteratively until a status notification indicates that compliance with the one or more of the rules has been met at the one of the plurality of remote workload nodes.   
     
     
         18 . The system of  claim 17 , wherein the program instructions are further executable to save the real-time non-compliance event data in a data store with the status notification, thereby generating an event tracking log. 
     
     
         19 . The system of  claim 15 , wherein the program instructions are further executable to extract information from the real-time non-compliance event data including information identifying the one of the plurality of remote workload nodes associated with the event and a cause of the event. 
     
     
         20 . The system of  claim 19 , wherein the extracting the information from the real-time non-compliance event data comprises: parsing the real-time non-compliance event data using additional natural language processing, thereby generating parsed data; extracting the one of the plurality of remote workload node nodes associated with the event from the parsed data; and extracting the cause of the non-compliance from the parsed data.