Tracking events of interest in a live production environment

A method comprising:

• executing, by an edge device, a target software in a live production environment;
• identifying, by the edge device, a service level entry point of the endpoint of the target software;
• initiating, by the edge device, and in response to the identifying of the service level entry point, an endpoint tracking for tracking an execution flow of an endpoint of the target software, wherein the endpoint tracking comprises automatically monitoring invocations of functions within the execution flow of the endpoint;
• determining, by the edge device, whether to open an investigation to investigate a result of the execution flow of the endpoint, the determination of whether to open the investigation is based on:
• identifying an occurrence of a triggering event during tracking of the execution flow of the endpoint, the occurrence of the triggering event occurs during an execution of a function of the target software;
• computing a signature of the occurrence of the triggering event, the signature is computed based on:
• a descriptor of the endpoint, a descriptor of the function, and a descriptor of the triggering event;
• querying a tagged signature database to determine whether the signature matches a cluster of signatures within said tagged signature database;
• and
• determining to open the investigation in case the signature does not match any cluster of said tagged signature database;
• in case of an open investigation tagging the signature as an incident event or a non-incident event in response to reaching an end of the execution flow of the endpoint, and based on the result of the execution flow of the endpoint;
• updating said tagged signature database with the tag of the signature;
• and
• selectively sending data regarding the execution flow of the endpoint to a backend server, wherein the data comprises at least the signature.

A computer program product comprising a non-transitory computer readable medium retaining program instructions, which program instructions when read by a processor, cause the processor to:

• execute a target software in a live production environment;
• identify a service level entry point of the endpoint of the target software;
• initiate, in response to the identifying the service level entry point, an endpoint tracking for tracking an execution flow of an endpoint of the target software, wherein the endpoint tracking comprises automatically monitoring invocations of functions within the execution flow of the endpoint;
• determine whether to open an investigation to investigate a result of the execution flow of the endpoint, the determination of whether to open the investigation is based on:
• identifying an occurrence of a triggering event during tracking of the execution flow of the endpoint, the occurrence of the triggering event occurs during an execution of a function of the target software;
• computing a signature of the occurrence of the triggering event, the signature is computed based on:
• a descriptor of the endpoint, a descriptor of the function, and a descriptor of the triggering event;
• querying a tagged signature database to determine whether the signature matches a cluster of signatures within said tagged signature database;
• and
• determining to open the investigation in case the signature does not match any cluster of said tagged signature database;
• tag the signature as an incident event or a non-incident event in response to reaching an end of the execution flow of the endpoint, in case of an open investigation, and based on the result of the execution flow of the endpoint;
• update said tagged signature database with the tag of the signature;
• and
• selectively send data regarding the execution flow of the endpoint to a backend server, wherein the data comprises at least the signature.