  Root Cause Analysis (RCA) of any service-disrupting incident is one of the
most critical as well as complex tasks in IT processes, especially for cloud
industry leaders like Salesforce. Typically RCA investigation leverages
data-sources like application error logs or service call traces. However a rich
goldmine of root cause information is also hidden in the natural language
documentation of the past incidents investigations by domain experts. This is
generally termed as Problem Review Board (PRB) Data which constitute a core
component of IT Incident Management. However, owing to the raw unstructured
nature of PRBs, such root cause knowledge is not directly reusable by manual or
automated pipelines for RCA of new incidents. This motivates us to leverage
this widely-available data-source to build an Incident Causation Analysis (ICA)
engine, using SoTA neural NLP techniques to extract targeted information and
construct a structured Causal Knowledge Graph from PRB documents. ICA forms the
backbone of a simple-yet-effective Retrieval based RCA for new incidents,
through an Information Retrieval system to search and rank past incidents and
detect likely root causes from them, given the incident symptom. In this work,
we present ICA and the downstream Incident Search and Retrieval based RCA
pipeline, built at Salesforce, over 2K documented cloud service incident
investigations collected over a few years. We also establish the effectiveness
of ICA and the downstream tasks through various quantitative benchmarks,
qualitative analysis as well as domain expert's validation and real incident
case studies after deployment.
