# US 12,224,919 B1 · Hybrid execution of custom playbook codeblocks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,919 B1 - Document ID: US12224919B1 - Status: Granted - Kind: B1 - Application number: 18/630,909 - Filed: 2024-04-09 - Granted: 2025-02-11 - Earliest claimed: 2020-04-30 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Chakravarthy Sridhar; Minjie Qiu; Atif Mahadik - Web page: https://patentgrep.com/patent/US12224919B1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 3/04817: using icons (graphical or visual programming using iconic symbols G06F8/34) - G06F 8/34: Graphical or visual programming - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 41/0681: Configuration of triggering conditions - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0886: {Fully automatic configuration} - H04L 41/0894: Policy-based network configuration management - H04L 41/20: {Network management software packages} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/0263: {Rule management} - H04L 63/0281: {Proxies} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/1004: Server selection for load balancing - H04L 43/0817: by checking functioning - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/18: Protocol analysers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are described for enabling a cloud-based IT and security operations application to execute playbooks containing custom code in a manner that mitigates types of risk related to the misuse of cloud-based resources and security of user data. Users use a client application to create and modify playbooks and, upon receiving input to save a playbook, the client application determines whether the playbook includes custom code. If the client application determines that the playbook includes custom code, the client application establishes a connection with a proxy application (also referred to as an “automation broker”) running in the user's own on-premises network and sends a representation of the playbook to the proxy application. The client application further sends to the IT and security operations application an identifier of the playbook and an indication that the playbook (or the custom code portions of the playbook) is stored within the user's on-premises network. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, at an information technology (IT) and security operations application executing in a cloud provider network, one or more messages carrying data defining a user-configured playbook, the user-configured playbook identifying a plurality of codeblocks implementing operations to be performed to respond to an identification of an incident occurring in an IT environment associated with a user, the plurality of codeblocks including at least a first codeblock associated with custom code provided by the user and a second codeblock; and upon a detection of the incident in the IT environment, initiating execution of the user-configured playbook by the IT and security operations application, the initiating comprising: sending, to a proxy application executing in the IT environment, a request to execute at least the custom code of the first codeblock; and causing at least the second codeblock to be executed within the cloud provider network. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the custom code is stored in a version-control system repository in the IT environment and is executed by a playbook execution engine running on compute resources in the IT environment. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein execution of the custom code in the IT environment includes performing an action that involves interaction with a computing resource running in the cloud provider network. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein execution of the custom code in the IT environment includes performing an action that involves interaction with a computing resource within the IT environment. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising causing display of a playbook editor graphical user interface (GUI) providing representations of the plurality of codeblocks. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the detection of the incident is performed by the IT and security operations application based on data obtained from a data intake and query system running in the cloud provider network. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: upon a detection of a different type of incident in the IT environment, initiating execution, by the IT and security operations application, of a different playbook entirely within the cloud provider network. ### Claim 8 A computer-implemented method comprising: receiving, at an information technology (IT) and security operations application executing in a cloud provider network, one or more messages including an identifier of a user-configured playbook, the user-configured playbook identifying a plurality of codeblocks implementing operations to be performed to respond to detected incidents, of a first type, occurring in an IT environment associated with a user; upon a detection, by the IT and security operations application, of a first incident of the first type occurring in the IT environment, initiating execution of the user-configured playbook within the IT environment, the initiating comprising sending, to a proxy application executing in the IT environment, a request to execute the user-configured playbook; and upon a detection, by the IT and security operations application, of a second incident of a second type occurring in the IT environment, initiating an execution of a second playbook within the cloud provider network, wherein the second playbook is different than the user-configured playbook. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the plurality of codeblocks of the user-configured playbook includes at least a first codeblock having custom code provided by the user. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, further comprising providing data for a playbook editor graphical user interface (GUI) providing representations of the plurality of codeblocks. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the playbook editor GUI further includes one or more panels allowing user input for providing or customizing codeblocks, wherein the user utilized the one or more panels to provide the custom code. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, wherein the first codeblock is associated with at least one custom name provided by the user, wherein the custom name is associated with an output value of the first codeblock, and wherein the custom name is referenced by at least one other codeblock of the plurality of codeblocks. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, wherein execution of the user-configured playbook in the IT environment includes performing an action that involves interaction with a computing resource within the IT environment. ### Claim 14 (depends on 8) The computer-implemented method of claim 8, wherein the detection of the first incident and the detection of the second incident is performed by the IT and security operations application based on data obtained from a data intake and query system running in the cloud provider network. ### Claim 15 A non-transitory, computer-readable medium having stored thereon instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to implement an information technology (IT) and security operations application in a cloud provider network that performs operations comprising: receive one or more messages carrying data defining a user-configured playbook, the user-configured playbook identifying a plurality of codeblocks implementing operations to be performed to respond to an identification of an incident occurring in an IT environment associated with a user, the plurality of codeblocks including at least a first codeblock associated with custom code provided by the user and a second codeblock; and upon a detection of the incident in the IT environment, initiate execution of the user-configured playbook, the initiation comprising: sending, to a proxy application executing in the IT environment, a request to execute at least the custom code of the first codeblock; and causing at least the second codeblock to be executed within the cloud provider network. ### Claim 16 (depends on 15) The non-transitory, computer-readable medium of claim 15, wherein the custom code is stored in a version-control system repository in the IT environment and is executed by a playbook execution engine running on compute resources in the IT environment. ### Claim 17 (depends on 15) The non-transitory, computer-readable medium of claim 15, wherein execution of the custom code in the IT environment includes performing an action that involves interaction with a computing resource running in the cloud provider network. ### Claim 18 (depends on 15) The non-transitory, computer-readable medium of claim 15, wherein execution of the custom code in the IT environment includes performing an action that involves interaction with a computing resource within the IT environment. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the non-transitory computer-readable medium has stored thereon further instructions which, when executed by the one or more processors, cause the IT and security operations application to perform the operations further comprising: causing display of a playbook editor graphical user interface (GUI) providing representations of the plurality of codeblocks. ### Claim 20 (depends on 15) The non-transitory, computer-readable medium of claim 15, wherein the detection of the incident is performed by the IT and security operations application based on data obtained from a data intake and query system running in the cloud provider network.