US 12,445,344 B1 · Executing playbooks against aggregate notable events in an information technology and security operations application

Abstract

Techniques are described for an IT and security operations application to automatically generate aggregate (or “bulk,” “group,” or “composite”) notable events by identifying notable events sharing common characteristics and aggregating the related notable events into a single aggregate notable event entity that can be displayed and operated upon. The IT and security operations application identifies related notable events based on notable events generated by a common correlation search, notable events having common event attributes, based on user-specified relatedness criteria, or other such criteria. Once identified, in some embodiments, the IT and security operations application displays, in notable event lists and other interfaces, a singular aggregate notable event to users representing each of the identified related notable events.

Claims20

Dependent claims

A computer-implemented method comprising:

obtaining, by an IT and security operations application, data reflecting operation of computing devices in an IT environment;
generating a plurality of timestamped events based on the data;
identifying, at a first point in time, a first notable event, wherein the first notable event is identified by determining that one or more timestamped events of the plurality of timestamped events match defined notable event criteria;
identifying, at a second point in time, a second notable event;
determining that the first notable event is related to the second notable event;
adding the first notable event and the second notable event to an aggregate notable event;
receiving input requesting execution of a playbook on the aggregate notable event;
and
executing the playbook using the first notable event and the second notable event as input to the playbook.

6 more elements

A computing device, comprising:

a processor;
and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
obtaining, by an IT and security operations application, data reflecting operation of computing devices in an IT environment;
generating a plurality of timestamped events based on the data;
identifying, at a first point in time, a first notable event, wherein the first notable event is identified by determining that one or more timestamped events of the plurality of timestamped events match defined notable event criteria;
identifying, at a second point in time, a second notable event;
determining that the first notable event is related to the second notable event;
adding the first notable event and the second notable event to an aggregate notable event;
receiving input requesting execution of a playbook on the aggregate notable event;
and
executing the playbook using the first notable event and the second notable event as input to the playbook.

9 more elements

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

obtaining, by an IT and security operations application, data reflecting operation of computing devices in an IT environment;
generating a plurality of timestamped events based on the data;
identifying, at a first point in time, a first notable event, wherein the first notable event is identified by determining that one or more timestamped events of the plurality of timestamped events match defined notable event criteria;
identifying, at a second point in time, a second notable event;
determining that the first notable event is related to the second notable event;
adding the first notable event and the second notable event to an aggregate notable event;
receiving input requesting execution of a playbook on the aggregate notable event;
and
executing the playbook using the first notable event and the second notable event as input to the playbook.

6 more elements

Dependencies are inferred from the claim text.

Executing playbooks against aggregate notable events in an information technology and security operations application

Life of this patent

Executing playbooks against aggregate notable events in an information technology and security operations application

Life of this patent

Abstract

Claims20