# US 12,598,218 B2 · Hybrid execution of custom playbook codeblocks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,598,218 B2 - Document ID: US12598218B2 - Status: Granted - Kind: B2 - Application number: 19/001,194 - Filed: 2024-12-24 - Published: 2025-04-24 - Granted: 2026-04-07 - Earliest claimed: 2020-04-30 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Chakravarthy Sridhar; Minjie Qiu; Atif Mahadik - Web page: https://patentgrep.com/patent/US12598218B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 3/04817: using icons (graphical or visual programming using iconic symbols G06F8/34) - G06F 8/34: Graphical or visual programming - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 41/0681: Configuration of triggering conditions - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0886: {Fully automatic configuration} - H04L 41/0894: Policy-based network configuration management - H04L 41/20: {Network management software packages} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/0263: {Rule management} - H04L 63/0281: {Proxies} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/1004: Server selection for load balancing - H04L 43/0817: by checking functioning - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/18: Protocol analysers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are described for enabling a cloud-based IT and security operations application to execute playbooks containing custom code in a manner that mitigates types of risk related to the misuse of cloud-based resources and security of user data. Users use a client application to create and modify playbooks and, upon receiving input to save a playbook, the client application determines whether the playbook includes custom code. If the client application determines that the playbook includes custom code, the client application establishes a connection with a proxy application (also referred to as an “automation broker”) running in the user's own on-premises network and sends a representation of the playbook to the proxy application. The client application further sends to the IT and security operations application an identifier of the playbook and an indication that the playbook (or the custom code portions of the playbook) is stored within the user's on-premises network. ## Claims ### Claim 1 A computer-implemented method comprising: sending, by an information technology (IT) and security operations application executing in a cloud provider network, resources to facilitate configuring of a playbook, wherein the configured playbook identifies a plurality of code blocks that define operations to be performed to respond to an identification of an incident occurring in an IT environment associated with a user, and the plurality of code blocks comprises custom code provided by the user; causing, by the IT and security operations application, at least part of the configured playbook, including the custom code, to be stored in a user's network in preparation for future execution of the at least part of the configured playbook, wherein the user's network is external to the cloud provider network; and consequent to a detection of the incident in the IT environment, sending, to a proxy application executing in the user's network, a request to execute the at least part of the configured playbook, wherein the request causes execution of the at least part of the configured playbook, including the custom code, in the user's network. ### Claim 2 (depends on 1) The computer-implemented method as recited in claim 1, wherein a client device establishes a connection to the proxy application using a tunnel bridge that establishes a secure connection between the client device and the tunnel bridge and between the tunnel bridge and the proxy application in the user's network. ### Claim 3 (depends on 1) The computer-implemented method as recited in claim 1, wherein the request to execute the at least part of the configured playbook is generated automatically responsive to the IT and security operations application identifying the incident. ### Claim 4 (depends on 1) The computer-implemented method as recited in claim 1, wherein the at least part of the configured playbook is stored in a version-control system repository in the user's network. ### Claim 5 (depends on 1) The computer-implemented method as recited in claim 1, wherein the execution of the at least part of the configured playbook comprises performing an action that involves interaction with a computing resource running in the cloud provider network. ### Claim 6 (depends on 1) The computer-implemented method as recited in claim 1, wherein the user's network is associated with a first tenant of the IT and security operations application, and wherein the playbook was created by a second tenant of the IT and security operations application that is different from the first tenant. ### Claim 7 (depends on 1) The computer-implemented method as recited in claim 1, further comprising: upon a detection of a different type of incident in the IT environment, initiating execution, by the IT and security operations application, of a different playbook entirely within the cloud provider network. ### Claim 8 A non-transitory, computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause a system in a cloud provider network to perform operations comprising: sending resources to facilitate configuring of a playbook, wherein the configured playbook identifies a plurality of code blocks that define operations to be performed to respond to an identification of an incident occurring in an information technology (IT) environment associated with a user, and the plurality of code blocks comprises custom code provided by the user; causing at least part of the configured playbook, including the custom code, to be stored in a user's network in preparation for future execution of the at least part of the configured playbook, wherein the user's network is external to the cloud provider network; and consequent to a detection of the incident in the IT environment, sending, to a proxy application executing in the user's network, a request to execute the at least part of the configured playbook, wherein the request causes execution of the at least part of the configured playbook, including the custom code, in the user's network. ### Claim 9 (depends on 8) The non-transitory, computer-readable medium as recited in claim 8, wherein a client device establishes a connection to the proxy application using a tunnel bridge that establishes a secure connection between the client device and the tunnel bridge and between the tunnel bridge and the proxy application in the user's network. ### Claim 10 (depends on 8) The non-transitory, computer-readable medium as recited in claim 8, wherein the request to execute the at least part of the configured playbook is generated automatically responsive to the IT and security operations application identifying the incident. ### Claim 11 (depends on 8) The non-transitory, computer-readable medium as recited in claim 8, wherein the at least part of the configured playbook is stored in a version-control system repository in the user's network. ### Claim 12 (depends on 8) The non-transitory, computer-readable medium as recited in claim 8, wherein the execution of the at least part of the configured playbook comprises performing an action that involves interaction with a computing resource running in the cloud provider network. ### Claim 13 (depends on 8) The non-transitory, computer-readable medium as recited in claim 8, wherein the user's network is associated with a first tenant of the IT and security operations application, and wherein the playbook was created by a second tenant of the IT and security operations application that is different from the first tenant. ### Claim 14 (depends on 8) The non-transitory, computer-readable medium as recited in claim 8, the operations further comprising: upon a detection of a different type of incident in the IT environment, initiating execution of a different playbook entirely within the cloud provider network. ### Claim 15 A system comprising: one or more processing devices to implement an information technology (IT) and security operations application executing in a cloud provider network and perform operations comprising: sending resources to facilitate configuring of a playbook, wherein the configured playbook identifies a plurality of code blocks that define operations to be performed to respond to an identification of an incident occurring in an IT environment associated with a user, and the plurality of code blocks comprises custom code provided by the user; causing at least part of the configured playbook, including the custom code, to be stored in a user's network in preparation for future execution of the at least part of the configured playbook, wherein the user's network is external to the cloud provider network; and consequent to a detection of the incident in the IT environment, sending, to a proxy application executing in the user's network, a request to execute the at least part of the configured playbook, wherein the request causes execution of the at least part of the configured playbook, including the custom code, in the user's network. ### Claim 16 (depends on 15) The system as recited in claim 15, wherein a client device establishes a connection to the proxy application using a tunnel bridge that establishes a secure connection between the client device and the tunnel bridge and between the tunnel bridge and the proxy application in the user's network. ### Claim 17 (depends on 15) The system as recited in claim 15, wherein the request to execute the at least part of the configured playbook is generated automatically responsive to the IT and security operations application identifying the incident. ### Claim 18 (depends on 15) The system as recited in claim 15, wherein the at least part of the configured playbook is stored in a version-control system repository in the user's network. ### Claim 19 (depends on 15) The system as recited in claim 15, wherein the execution of the at least part of the configured playbook comprises performing an action that involves interaction with a computing resource running in the cloud provider network. ### Claim 20 (depends on 15) The system as recited in claim 15, wherein the user's network is associated with a first tenant of the IT and security operations application, and wherein the playbook was created by a second tenant of the IT and security operations application that is different from the first tenant.