# US 2021/0281602 A1 · Generating action recommendations for courses of action used for incident response > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0281602 A1 - Document ID: US20210281602A1 - Status: Published application - Kind: A1 - Application number: 17/327,098 - Filed: 2021-05-21 - Published: 2021-09-09 - Earliest claimed: 2018-07-31 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Oliver Friedrichs; Atif Mahadik; Govind Salinas; Sourabh Satish - Web page: https://patentgrep.com/patent/US20210281602A1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Described herein are systems and methods for enhancing an interface for an information technology (IT) environment. In one implementation, an incident service causes display of a first version of a course of action and obtains input indicative of a request for a new action in the course of action. The incident service further determines suggested actions based at least one the input and causes display of the suggested actions. Once displayed, the incident service obtains input indicative of a selection of at least one action from the suggested actions, and causes display input indicative of a selection of at least one action from the suggested actions. ## Claims ### Claim 1 A computer-implemented method, comprising: causing display of a first version of a course of action comprising a plurality of actions used to respond to occurrences of incidents in an information technology (IT) environment, wherein the course of action defines an operational flow of the plurality of actions, and wherein the IT environment includes a plurality of types of services; obtaining input requesting addition of a new action to the course of action, wherein the new action is to be linked to an action of the plurality of actions; determining a suggested action based on a type of service from the plurality of types of services, wherein execution of the suggested action involves interacting with a service of the type of service in the IT environment; causing display of the suggested action; obtaining input selecting the suggested action; and causing display of a second version of the course of action, wherein the second version of the course of action includes the plurality of actions of the first version of the course of action and the suggested action. ### Claim 2 (depends on 1) The method of claim 1, wherein the suggested action is a first suggested action, wherein the type of service is a first type of service, and wherein the method further comprises: determining a second suggested action based on a second type of service from the plurality of types of services, wherein execution of the second suggested action involves interacting with a service of the second type of service in the IT environment; and causing display of the second suggested action in association with the first suggested action. ### Claim 3 (depends on 1) The method of claim 1, wherein the suggested action is a first suggested action, wherein the IT environment further includes a plurality of types of computing devices, and wherein the method further comprises: determining a second suggested action based on a type of computing device from the plurality of types of computing devices, wherein execution of the second suggested action involves interacting with a computing device of the type of computing device in the IT environment; and causing display of the second suggested action in association with the first suggested action. ### Claim 4 (depends on 1) The method of claim 1, wherein the suggested action is further determined based on: a type of action associated with the action to which the new action is to be linked, or a type of incident associated with the incidents to which the course of action is used to respond. ### Claim 5 (depends on 1) The method of claim 1, wherein the first version of the course of action is displayed in a graphical user interface (GUI) including a flow diagram indicative of the operational flow of the plurality of actions, and wherein the input requesting addition of the new action to the course of action includes a request to link the new action to at least one of the plurality of actions in the flow diagram. ### Claim 6 (depends on 1) The method of claim 1, wherein the plurality of actions includes an action that, upon execution, performs at least one of: identifying supplemental information associated with an incident, modifying a configuration of at least one component of the IT environment, or determining a path of the course of action upon which to proceed. ### Claim 7 (depends on 1) The method of claim 1, further comprising: identifying trends in action sequences associated with other courses of action; and wherein the suggested action is further determined based on the identified trends in action sequences associated with other courses of action. ### Claim 8 (depends on 1) The method of claim 1, wherein the IT environment is a first IT environment, and wherein the method further comprises: identifying trends in action sequences associated with other courses of action, wherein at least one of the other courses of action was created by an analyst associated with a second IT environment that is different from the first IT environment; and wherein the suggested action is further determined based on the identified trends in action sequences associated with other courses of action. ### Claim 9 (depends on 1) The method of claim 1, further comprising: identifying trends in action sequences associated with other courses of action, wherein the action sequences are linked to a type of action that is the same as the action to which the new action is to be linked; and wherein the suggested action is further determined based on the identified trends in action sequences associated with other courses of action. ### Claim 10 (depends on 1) The method of claim 1, further comprising: identifying a type of service from the plurality of types of services relevant to the action to which the new action is to be linked; causing display of an indication of the type of service; and wherein the suggested action is determined based on the type of service. ### Claim 11 (depends on 1) The method of claim 1, wherein the suggested action is associated with an instruction set that, upon execution, implements the suggested action in the IT environment. ### Claim 12 (depends on 1) The method of claim 1, wherein determining a suggested action includes accessing a response database that includes action sequencing information for courses of action. ### Claim 13 (depends on 1) The method of claim 1, further comprising receiving input specifying a type of incident for which the course of action is to be used to respond, and wherein the suggested action is further determined based on the type of incident. ### Claim 14 (depends on 1) The method of claim 1, wherein the action to which the new action is to be linked returns a type of data as output, and wherein the suggested action is further determined based on the type of data. ### Claim 15 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising: causing display of a first version of a course of action comprising a plurality of actions used to respond to occurrences of incidents in an information technology (IT) environment, wherein the course of action defines an operational flow of the plurality of actions, and wherein the IT environment includes a plurality of types of services; obtaining input requesting addition of a new action to the course of action, wherein the new action is to be linked to an action of the plurality of actions; determining a suggested action based on a type of service from the plurality of types of services, wherein execution of the suggested action involves interacting with a service of the type of service in the IT environment; causing display of the suggested action; obtaining input selecting the suggested action; and causing display of a second version of the course of action, wherein the second version of the course of action includes the plurality of actions of the first version of the course of action and the suggested action. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the suggested action is further determined based on: a type of action associated with the action to which the new action is to be linked, or a type of incident associated with the incidents to which the course of action is used to respond. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the first version of the course of action is displayed in a graphical user interface (GUI) including a flow diagram indicative of the operational flow of the plurality of actions, and wherein the input requesting addition of the new action to the course of action includes a request to link the new action to at least one of the plurality of actions in the flow diagram. ### Claim 18 An apparatus, comprising: one or more processors; a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the apparatus to: cause display of a first version of a course of action comprising a plurality of actions used to respond to occurrences of incidents in an information technology (IT) environment, wherein the course of action defines an operational flow of the plurality of actions, and wherein the IT environment includes a plurality of types of services; obtain input requesting addition of a new action to the course of action, wherein the new action is to be linked to an action of the plurality of actions; determine a suggested action based on a type of service from the plurality of types of services, wherein execution of the suggested action involves interacting with a service of the type of service in the IT environment; cause display of the suggested action; obtain input selecting the suggested action; and cause display of a second version of the course of action, wherein the second version of the course of action includes the plurality of actions of the first version of the course of action and the suggested action. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the suggested action is further determined based on: a type of action associated with the action to which the new action is to be linked, or a type of incident associated with the incidents to which the course of action is used to respond. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the first version of the course of action is displayed in a graphical user interface (GUI) including a flow diagram indicative of the operational flow of the plurality of actions, and wherein the input requesting addition of the new action to the course of action includes a request to link the new action to at least one of the plurality of actions in the flow diagram.