Legacy Event Manager Replacement

Why IT leaders are replacing their legacy Manager of Managers (MoM) now?

Are your users or customers finding service disruptions before you do, as you sink in a sea of events and alerts? Are you struggling to maintain rules and models but losing visibility in an increasingly dynamic and complex IT environment? Are you still getting invoiced for costly maintenance fees while your legacy MoM vendor has long stopped providing any innovations?

You are not alone. As validated in a recent study by Forrester Research, users and customers reported nearly 75% of incidents before operational teams detected them. As a result, over the past 12 months, IT organizations worldwide have replaced their crumbling legacy MoMs with modern, machine-learning based solutions.

2 million customer impacts NOT caught by existing tools (Large UK ISP)

74% of outages reported by customers not existing tools (Global web brand)

Customer Impacts NOT.

How Incident.MOOG is better than your legacy event manager?

Moogsoft provides the first next-generation Manager-of-Managers (MoM), Incident.MOOG, to accelerate incident detection and remediation in complex IT environments, from the applications down to the underlying infrastructures. The following table summarizes the many functional differences between a legacy MoM and Moogsoft’s Incident. MOOG.

Key Capabilities
  • Parity with legacy rule-based event manager:

    Built from the ground up by the original inventors of IBM Tivoli Netcool, Incident.MOOG gives you complete feature parity with legacy MoMs.

  • Ingest any textual event stream in billions/day:

    Built with a modern Link Access Module (LAM), Incident.MOOG can rapidly accommodate your existing and future event data emitted by software-defined, cloud-centric, mobility-driven IT environments.

  • Agile, unsupervised machine learning engine:

    Scale to the speed, scope and scale of events. Without relying on rules, Incident.MOOG automatically “learns” your constantly changing interdependency among applications and underlying infrastructure elements.

Key Capabilities
  • Massive, automatic noise reduction:

    To be truthful, IBM Tivoli Netcool does have some basic noise reduction capabilities. Incident.MOOG however, has been proven at customer production sites to reduce event noise by additional 55-60%.

  • Real-time incident detection, not retrospective:

    Incident.MOOG takes live event streams straight from the sources, not having to wait for logs to arrive at the warehouse. Can your legacy MoM do that?

  • Automatic incident narrative clustering:

    Group multiple seemingly unrelated alerts into a single situation, with context showing cross-domain how causes and impacts unfold.

  • Instant virtual war room:

    Incident.MOOG gives you a true single pane of glass overlaying all domain-specific monitoring tools. Only the relevant experts are invited to diagnose and remediate, looking at the same context – with the same causes and impacts – across domains of apps, hybrid clouds, databases, compute, storage, and networks.

  • Automatic knowledge capturing and recycling:

    When a 3am troubleshooting is over, who has the energy to capture best practices? Incident.MOOG does that automatically for you.

  • Modern, RESTful API for rapid, two-way, custom integrations with any popular service management solutions:

    Incident.MOOG automatically invites your experts via any popular group chat tools and synchronizes with your ticketing systems. So when users call for a status update, your support staff not only has the insights on causes and impacts, but also has one tenth of tickets to handle!


What are the best adoption strategies for replacing your legacy event manager?

There are three ways to adopt Incident.MOOG:

Rip and replace:

Replacing your current collection of legacy MoMs with a modern MoM represents the long-term solution to your current MoM frustrations. This gives you a quantum leap immediately on event processing capacity while adapting rapidly to changing circumstances. At the same time, you can drastically reduce the number of rules you need to maintain and the number of events you need to analyze. You immediately have the ability to add new data streams easily, and Situation Room collaboration will make issue resolution much more efficient.

Rip and Replace


If immediate replacement of your existing infrastructure isn’t possible, then uniting your existing tools under Incident. MOOG can often be the best place to start. It leaves the underlying tools in place; redirecting their raw event data output to Incident.MOOG is easily accomplished. This immediately feeds Incident.MOOG with the full event stream, priming the machine learning to adapt to your unique environment.

Unite your Collection


You can begin by adding new types of data and event streams in your situation assessments – ones that your legacy MoM can’t handle.

This is a logical next step towards the eventual replacement of the legacy MoMs, done in a well-considered, unhurried fashion that adds powerful capabilities without putting existing functions at risk.

Strategy Augment your Legacy

Link to additional resources