AI for DevOps (AIOps) in Heard Island and McDonald Islands

Problem Statement: IT Security and Governance Challenges

An enterprise organisation managing cloud infrastructure, applications, and CI/CD pipelines faced challenges in maintaining IT security, operational reliability, and governance compliance. Security logs, application events, infrastructure metrics, and monitoring alerts were distributed across multiple systems, making it difficult for IT and security teams to identify unusual activity and respond to incidents promptly.

The organisation experienced excessive alerts, delayed incident investigations, limited visibility into infrastructure changes, and difficulties maintaining consistent audit records. Manual monitoring increased the risk of overlooking suspicious behaviour, unauthorised configuration changes, and potential policy violations. The organisation needed an intelligent, data-driven approach to improve security monitoring, streamline incident response, and strengthen governance without compromising human oversight or established security controls.

How Did We Overcome the Challenges?

• Intelligent Log Analysis: Analysed sample system, application, and security logs to identify recurring patterns, unusual events, and potential indicators of suspicious activity.
• AI-Based Anomaly Detection: Applied anomaly detection techniques to simulated infrastructure metrics and event data to highlight deviations from normal operational behaviour.
• Alert Correlation and Prioritisation: Grouped related alerts from different monitoring sources to reduce duplicate notifications and help teams prioritise incidents based on severity and potential business impact.
• Automated Incident Workflows: Designed controlled workflows for alert enrichment, incident ticket creation, notifications, and escalation, with approval requirements for sensitive actions.
• Security and Access Governance: Incorporated role-based access control, least-privilege principles, secure handling of operational data, and appropriate access restrictions for logs and monitoring tools.
• Auditability and Compliance Monitoring: Established structured incident records containing event timestamps, investigation notes, response actions, approvals, and outcomes to support audit reviews.
• Human Oversight and Validation: Required security or operations personnel to review AI-generated alerts and recommendations before taking high-impact actions, reducing reliance on unverified automated decisions.

Overall Implementation

The project was implemented as a practical AIOps use case in a simulated enterprise IT security and governance environment.

• Collect Operational Data: Gathered sample infrastructure metrics, application logs, security events, deployment records, and configuration-change information from simulated monitoring sources.
• Prepare and Analyse the Data: Cleaned and normalised the sample data, aligned timestamps, removed duplicate events, and identified relevant operational patterns for analysis.
• Configure Anomaly Detection: Established baseline behaviour and applied suitable rule-based or machine-learning techniques to flag unusual resource utilisation, unexpected event frequency, and suspicious changes.
• Correlate and Prioritise Alerts: Combined related events into incident groups, assigned severity levels based on predefined criteria, and highlighted cases requiring further investigation.
• Integrate Incident Management: Designed a workflow to create incident records, attach relevant evidence, notify the appropriate teams, and escalate unresolved or high-priority cases.
• Apply Security and Governance Controls: Integrated access restrictions, approval checkpoints, audit logging, data-protection practices, and documented response procedures into the proposed workflow.
• Validate the Solution: Tested the workflow using simulated normal activity, unusual operational behaviour, unauthorised-change scenarios, and duplicate alerts. Reviewed detection quality, false positives, incident traceability, and the suitability of recommended responses.
• Document and Present Results: Prepared an implementation report describing the problem, data sources, detection approach, workflow design, governance controls, test findings, limitations, and recommended improvements.

Learner Outcomes

After completing this practical project, learners should be able to:

• Explain how AIOps supports IT operations, security monitoring, and governance processes.
• Identify appropriate operational data sources for intelligent monitoring.
• Apply anomaly detection concepts to simulated logs, metrics, and security events.
• Correlate related alerts and prioritise incidents using defined criteria.
• Design AI-assisted incident investigation and escalation workflows.
• Integrate security approvals and human oversight into automated operations.
• Apply access-control, auditability, and data-protection principles to AIOps solutions.
• Evaluate detection results, false positives, and operational limitations.
• Document incident evidence and communicate findings to technical and governance stakeholders.
• Recommend improvements to monitoring, incident response, and operational compliance processes.

Evidence of Learning and Assessment

Learners can demonstrate their knowledge through the following project deliverables:

• Problem Analysis: A documented assessment of IT security, monitoring, and governance challenges.
• Data Preparation Evidence: Sample datasets, data-cleaning steps, and event-normalisation records.
• Detection Evidence: Example anomaly outputs, alert classifications, and documented detection criteria.
• Incident Correlation Evidence: Before-and-after examples showing how related alerts are grouped and prioritised.
• Workflow Evidence: A diagram or demonstration of incident creation, notification, escalation, and approval steps.
• Governance Evidence: A checklist covering role-based access, audit trails, data handling, and human approval requirements.
• Testing Evidence: Test cases, expected results, observed results, and notes on false positives or missed detections.
• Final Project Report: A summary of the implementation, learner contributions, findings, limitations, and proposed next steps.

Expected Business and Operational Benefits

When implemented appropriately, this approach can help organisations improve operational visibility, identify unusual behaviour earlier, reduce repetitive alert handling, and make incident investigations more consistent. Structured records and approval checkpoints can also strengthen accountability, support internal audit activities, and improve alignment with organisational security policies.

AI-generated findings should be treated as decision-support signals rather than definitive proof of a security incident. Actual performance improvements and compliance outcomes must be measured in the organisation’s environment; they should not be assumed from a training exercise.

Overall Project Outcome

This AI for DevOps (AIOps) project demonstrates how intelligent monitoring and controlled automation can support IT security and governance. By combining operational data analysis, anomaly detection, alert correlation, incident workflows, and audit-friendly documentation, learners gain practical experience designing an AIOps approach that balances efficiency with security, accountability, and human oversight.

Training application: StepMerit’s AI for DevOps (AIOps) training in Heard Island and McDonald Islands can use this scenario to help learners connect AIOps concepts with practical enterprise security and governance challenges.