Back to results
US 10,757,093 B1Granted
Identification of runtime credential requirements
AssigneeSplunk Inc.
InventorsGovind Salinas, Sourabh Satish, Robert John Truesdell
Life of this patent
Estimating the term…
Abstract
Described herein are systems, methods, and software to enhance incident response in an information technology (IT) environment. In one example, an incident service identifies a course of action to respond to an incident in the IT environment. The incident service further identifies a particular step in the course of action associated with a credential requirement based on traits associated with the particular step, and generates a credential request to obtain credentials to support the credential requirement.
Claims30
A computer-implemented method implemented by an incident service computing system, the method comprising:
- obtaining, by the incident service computing system, an indication of an incident in an IT environment, the IT environment including a plurality of computing assets, the incident encountered in one or more of the plurality of computing assets in the IT environment;
- selecting, by the incident service computing system, a course of action, from a plurality of courses of action, to respond to the incident in the IT environment, wherein the course of action is selected based on a parameter associated with the incident, wherein the course of action comprises one or more steps, and wherein the incident service computing system issues the one or more steps to the plurality of computing assets for execution by the plurality of computing assets;
- during execution of the course of action, determining, by the incident service computing system, prior to execution of a particular step of the one or more steps, that the particular step of the one or more steps is associated with a credential requirement based on one or more traits associated with the particular step;
- generating, by the incident service computing system, a credential request to satisfy the credential requirement;
- obtaining, by the incident service computing system, a credential in response to the credential request;
- and
- resuming, by the incident service computing system, execution of the course of action, wherein the resuming includes using the credential to perform the particular step.
4 more elements
A system comprising:
- a processor;
- a non-transitory computer readable storage medium storing instructions which,
- when executed by the processor, cause the processor to:
- obtain an indication of an incident in an IT environment, the IT environment including a plurality of computing assets, the incident encountered in one or more of the plurality of computing assets in the IT environment;
- select a course of action, from a plurality of courses of action, to respond to the incident in the information technology (IT) environment, wherein the course of action is selected based on a parameter associated with the incident, wherein the course of action comprises one or more steps, and wherein the system issues the one or more steps to the plurality of computing assets for execution by the plurality of computing assets;
- during execution of the course of action, determine one or more traits associated with the one or more steps;
- determine, prior to execution of a particular step of the one or more steps, that the particular step of the one or more steps is associated with a credential requirement based on one or more traits associated with the particular step;
- generate a credential request to satisfy the credential requirement;
- obtain a credential to satisfy the credential request in response to the credential request;
- and
- resume execution of the course of action, wherein the resuming includes using the credential to perform the particular step.
8 more elements
A non-transitory computer readable storage medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
- obtaining an indication of an incident in an IT environment, the IT environment including a plurality of computing assets, the incident encountered in one or more of the plurality of computing assets in the IT environment;
- selecting a course of action, from a plurality of courses of action, to respond to the incident in the information technology (IT) environment, wherein the course of action is selected based on a parameter associated with the incident, wherein the course of action comprises one or more steps to be issued to and executed by the plurality of computing assets in the IT environment;
- during execution of the course of action, determining, prior to execution of a particular step of the one or more steps, that the particular step of the one or more steps is associated with a credential requirement based on one or more traits associated with the particular step;
- generating a credential request to satisfy the credential requirement;
- obtaining a credential in response to the credential request;
- and
- resuming execution of the course of action, wherein the resuming includes using the credential to perform the particular step.
4 more elements
Dependencies are inferred from the claim text.