Deep Learning in ITSM and Monitoring: Anomaly Detection and Intelligent Automation

As a child, I had a VHS recording of Hamburger Hill, a Vietnam war film, and one of my frustrations was that the protagonists never saw the enemy. It was all jungle and, suddenly, the jungle started shooting. Just like in IT, where you constantly monitor every corner, everything seems fine until, suddenly, there’s a failure, an attack, or a disaster you didn’t see coming. To help us in that task and identify the enemy lurking in the jungle, we have deep learning applied to monitoring and ITSM.

With it, we can uncover patterns invisible to the human eye and react earlier, predict what’s about to happen, and generally save ourselves time, trouble, and defeats in our daily battle.

Aware that the most dangerous enemy is the one you can’t see, hidden in the thicket of silicon and bits, Pandora FMS and Pandora ITSM use deep learning techniques and other forms of artificial intelligence to detect anomalies, correlate complex events, and generally anticipate potential ambushes.

If we’re not using it daily as IT managers, CISOs or technology leaders, we’re like Sergeant Frantz’s platoon, looking everywhere but missing most of the threats.

That’s why we will analyze what deep learning is in IT and how Pandora FMS and Pandora ITSM use it in practice, to provide the most scarce asset in this job: peace of mind (and management approval for a job well done).

What is deep learning and how does it work?

Deep learning is a branch of the artificial intelligence tree and the natural evolution of machine learning. It’s the T-1000 to the T-800 from Terminator 2, although as we’ll see, and just like in the movie, the T-1000 is not always the best fit for every scenario.

Deep learning works through deep neural networks that learn feature hierarchies: first simple patterns, then complex combinations, and finally abstract system representations.

The key is that, unlike traditional models, the model itself decides which signals matter, hence the deeper learning that reduces the need for hand-crafted rules.

This enables training of multimodal models that combine metrics, ticket text, network traces, and conversations… A single model can integrate heterogeneous data such as CPU history, service relationships, or natural language associated with incidents.

Using a combination of stacked layer reviewing, activation and loss functions, or weights, this makes it possible in practice to find hidden patterns that are undetectable by traditional methods or human perception.

Within deep learning, various specialized architectures coexist:

• CNN (Convolutional Neural Networks): Initially created for image and spatial data processing, they are now widely used to analyze time series in IT.
• RNN and LSTM (Recurrent Neural Networks / Long Short-Term Memory): Handle temporal dependencies or sequences (like text, which is a word sequence). This allows us to predict, for instance, IT service outages or overloads based on those time series.
• Autoencoders: A very clever system in my opinion, as it “summarizes” (or encodes) input into its minimal essence and then decodes (expands) it. In doing so, it learns the “essence of normality”. If an input is encoded and its decoded output doesn’t match the expected essence, it implies an anomaly. In this way, it can detect anomalies without knowing what they are, simply because they don’t “fit” the expected pattern.
• Transformers: The technology behind the ubiquitous and ever-hungry Large Language Models (LLMs), helping to correlate events or generate contextualized responses, as in the case of Pandora ITSM’s chatbot.

How does deep learning differ from traditional machine learning?

The key distinction is that traditional machine learning requires a specialist to decide which metrics are important, which becomes unmanageable when dealing with thousands of variables instead of just dozens.
Deep learning, by contrast, automates the discovery of what matters and enhances representational capacity, identifying nonlinear relationships between metrics, tickets, and logs that were not explicitly defined.
In short, it can detect things in the IT jungle that even expert eyes cannot see.

Another major difference is that some traditional machine learning algorithms, like basic decision trees, struggle with large datasets, whereas a deep learning model improves as it is fed more data. Of course, only if that data is high quality, a key challenge we will address in more depth when discussing this technology’s limitations.

Does this mean machine learning is obsolete?
Not at all—just as Schwarzenegger (yes, I copied and pasted the name, like everyone else) proved against the T-1000.
Simple models are still ideal for quick diagnostics or when there is no historical data. That’s why a successful strategy is often hybrid:

• Traditional models for basic threshold checks.
• Deep learning for multivariable or predictive scenarios.

What are the applications of deep learning in IT monitoring?

All of this sounds great, but the question is: how does it help us in the daily chaos of IT management?
To avoid ending up like the squad in Hamburger Hill, we can rely on:

Anomaly detection in performance metrics

Classical detection relies on rigid thresholds, but deep learning builds dynamic profiles of what is normal in your context.
This allows more flexibility and accuracy. As a result, Pandora FMS uses these techniques to alert more precisely, reducing noise and preventing nervous breakdowns.

Failure prediction and proactive maintenance

Sequential models learn the lifecycle of disks, fans, CPUs, or logical services. By detecting subtle degradations (like slight temperature increases or IOPS drops), they predict possible failure windows.
Pandora FMS integrates these forecasts. The key is not just having a brain like Dr. Xavier from X-Men to detect the right signal, but also the ability to forecast the most likely future, like a more accurate Nostradamus.

Advanced event correlation in SIEM environments

This is the key strength of Pandora SIEM. It not only collects and displays millions of data points, but also connects the dots to present the full picture.
That is, it transforms information into actionable knowledge, identifying patterns and complex enemy ambushes. And yes, it also reduces false positives, which is great for our industry’s collective heart health.

How does deep learning enhance ITSM and support automation?

Deep learning multiplies our IT management capabilities with features such as:

Automatic ticket classification using AI

Like in a hospital emergency room, the first thing is triage to categorize and prioritize tickets as soon as possible.
Here, the use of transformers allows understanding the ticket’s semantics (which is usually “something broke” and “I didn’t touch anything,” according to the user), assigning priorities and agents based on that interpretation.

Chatbots for interaction and management

The Pandora ITSM chatbot combines language models with operational context. This enables user interaction or support for human operators in case of doubts or complex situations.

Sentiment analysis and service quality

The end-user experience also depends on how they feel when interacting with support. Models based on BERT can process comments, surveys, and chats to identify trends.

Real-world use cases of deep learning applied to IT management

Let’s keep hammering home the usefulness of deep learning in IT with practical cases where this technology improves efficiency, focusing on our own Skynet, Pandora FMS.

Use case in IT management: Predicting failures in servers and networks

A managed service provider collects two years of performance metrics and service outages. That’s a gold mine, but too deep for models like simple regressions or pure human analysis.
Pandora FMS can integrate and correlate it, extracting the gold from that mine by discovering patterns that help predict potential outages and alerting before they occur.

Security use case: Event correlation with Pandora FMS

If we move from pure management to security monitoring, deep learning’s power lies not only in big data processing but in its ability to detect sophisticated threats.
Pandora learns the “normality” of the monitored organization and, aware of the latest attack techniques, can detect events that individually don’t seem suspicious.
For example, suppose a user accesses systems at odd —but not impossible— hours, then connects to seemingly harmless servers like Google Drive. Pandora sees all of this like Sauron with his Palantir and keeps watching. Then, that user runs a PowerShell script, which deviates from organizational norms and, combined with the previous signs, smells like a threat.
In this scenario, Pandora FMS can correlate these isolated “harmless” events and suspect a potential data exfiltration attempt and act accordingly.
It sends an alert to the SOC and can even connect to a SOAR to trigger automated countermeasures like cutting the connection and blocking the user until the SOC investigates.

IT management use case: Optimizing cloud service scaling

Imagine an e-commerce company that wants to optimize both the cost of its cloud provider and prevent outages due to saturation, which would hurt sales and customer trust.
Occasionally —and not just on Black Friday— the company has had such problems, so it deploys Pandora FMS as the computer of its own Enterprise, collecting real-time data.
Pandora FMS learns through deep learning and considers the thresholds defined in the Metaconsole or Command Center (not naming it “Bridge” is a missed Trekkie opportunity).
Soon, it sends an alert predicting that, for instance, in 30–60 minutes, the database cluster will reach 95%, degrading the catalog service and causing a painfully slow user experience.
As we see, it not only prevents or predicts failures but also optimizes, enabling the organization to improve service satisfaction and meet potential contractual SLAs (Service Level Agreements).

What are the benefits and challenges of deep learning in IT?

We’ve already seen the benefits, and the key advantages over traditional monitoring can be summarized as:

• Holistic view: Models learn cross-relationships between applications, networks, and users.
• Less noise: By understanding context, false positives and alert fatigue are reduced.
• True automation: Predictions trigger alerts, classify incidents, or communicate with other tools, such as SOAR, enabling optimal, preventive, and proactive actions.
• Scalability: A trained model adapts to new services without the need to manually reconfigure hundreds of thresholds.

But of course, nothing is perfect, and deep learning still presents significant challenges, such as:

• Data quality: This is the foundation of everything, because deep learning is only as good as what it learns from. Therefore, if the data is mediocre, predictions and correlations will also be poor.
• Transparency: Here we face the “black box” problem, where in many cases, we do not really know why our deep learning model predicted or concluded something. This fundamental — and slightly frightening — problem is being mitigated with XAI (Explainable AI) techniques, but it remains a core challenge of how the technology works. After all, if we want it to detect patterns that “escape human understanding,” it’s hard to explain them in “human” terms.
• Hardware and data: Besides data, training models requires GPUs, energy, and resources, which are not unlimited.
• Cultural change: If work processes do not adopt the recommendations of deep learning, everything ends up as pretty dashboards and unused suggestions, making change management essential.

How do Pandora FMS and Pandora ITSM integrate intelligence based on deep learning?

Before we continue, it’s worth clarifying that Pandora FMS does not rely exclusively on deep learning to monitor everything from a single Iron Throne. As we’ve discussed, more traditional techniques can be just as useful — or even more so — depending on the scenario.

That’s why Pandora FMS also includes features such as capacity planning, which performs a forecast based on the time window specified by the user and assuming a more or less linear behavior of the target module.

But when it comes to IT management optimization through anomaly detection powered by AI, Pandora uses its MADE engine.

The large datasets required to train it are obtained from the Pandora FMS database, and MADE keeps a local copy of this data on disk to perform retraining and resampling tasks using the feather format, which is designed for efficient data storage.

In this way, we have the best of both worlds to ensure we use the most appropriate tool in every situation.

What is the future of deep learning in IT management?

In addition, Pandora ITSM integrates language models into its support functions, capable of responding to user queries in natural language, suggesting articles, and documenting every intervention.

Likewise, it adapts to the operational style of each organization, offering the ability to create workflow rules related to ticket handling and support processes.

What is the future of generative AI in IT?

Everyone has an opinion on artificial intelligence — and so do I. But the reality is that, regardless of how the game or its players evolve, it’s here to stay and it changes everything.

Not using deep learning in our IT management puts us at a disadvantage compared to competitors who do, especially when facing increasingly complex infrastructures and key data volumes that are unmanageable by traditional means. Being a Luddite may seem appealing at times, but it will only create unnecessary problems in our work.

Not only that, against increasingly sophisticated malicious actors who leverage this and other AI technologies for ever more complex attacks, going into battle without the power of deep learning is like wielding a wooden sword.

Looking ahead, we will likely see a convergence between deep learning, generative AI (which is based on deep learning), AIOps with operations automation, and RPA (Robotic Process Automation).

Models will not only detect anomalies but also suggest solutions, validate changes, and execute scripts in hybrid environments where machines and humans work together. Like Cyberpunk — but without implants and stripped of everything appealing.

No one truly knows what this future will look like, though many claim to. At Pandora FMS, we have always believed that deep learning equips IT managers with a lightsaber in place of the old wooden sword.

That said, deep learning is not a silver bullet, nor a master key that unlocks every door, as some claim. But it is the key to moving from reactive monitoring to proactive and more efficient management.

Instead of putting out fires — which defines the daily grind of IT — the goal is to prevent them through anomaly detection, failure prediction, and support automation, all made possible with Pandora’s tools.

Now, I must find that VHS tape in the attic…

FAQs

Let’s summarize the key questions about deep learning we’ve covered.

What is deep learning and how is it applied in IT?

It’s an approach based on deep neural networks that learn complex representations to detect anomalies, forecast demand, or automate IT management decisions.
Pandora FMS and ITSM use it to handle the heavy lifting of monitoring, management, and support.

What advantages does deep learning offer over traditional machine learning?

Greater representation capacity, automatic learning of features and infrastructure behavior, as well as improved performance with large data volumes and workloads.

How does deep learning improve anomaly detection in IT?

By learning the normal behavior of each service, identifying minimal deviations, and prioritizing alerts based on probable impact.
This reduces noise, anticipates problems, and supports effective resolution.

How is deep learning applied in ITSM and support automation?

Through intelligent ticket classification, chatbots that assist users and technicians with support, along with sentiment analysis and other features.
This boosts productivity for helpdesk and support teams.

What tools and hardware does deep learning require in IT?

High-quality governed data is essential (since output quality depends on input quality), computational power (local or cloud GPUs), as well as MLOps pipelines to train or version models and platforms that manage and apply results for better operations — as done by Pandora FMS and Pandora ITSM.