# US 2022/0035686 A1 · Responding to incidents identified by an information technology and security operations application using a mobile application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0035686 A1 - Document ID: US20220035686A1 - Status: Published application - Kind: A1 - Application number: 17/506,358 - Filed: 2021-10-20 - Published: 2022-02-03 - Earliest claimed: 2019-10-18 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Maryann CRISTOFI; Jeff ROECKS; Kavita VARADARAJAN - Web page: https://patentgrep.com/patent/US20220035686A1 ## CPC - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 9/44: Arrangements for executing specific programs - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are described for providing an IT and security operations mobile application for managing IT and security operations instances of an IT and security operations application via a mobile device. The IT and security operations mobile application can be linked to the IT and security operations application to enable the IT and security operations application to send messages (e.g., notifications, alerts, action requests, etc.) related the occurrences of incidents/events in an IT environment, such as security-related incident, that can impact the operation of the IT environment. The IT and security operations mobile application enables a user to respond to the messages by initiating actions that are sent to the IT and security operations application for executing within the IT environment. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, by an information technology (IT) and security operations mobile application executing on a mobile device, a request related to an executing workflow process, wherein the executing workflow process relates to an incident identified by the IT and security operations application monitoring an IT environment; causing display of a graphical user interface (GUI) including interface elements for responding to the request; receiving, via the interface elements, input indicating a response to the request, wherein the response requests execution of a playbook to be used to respond to the incident; and transmitting, by the IT and security operations mobile application, the response to the request, wherein the response to the request causes execution of the playbook by the IT and security operations application. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the interface elements include a user delegation interface element used to delegate the request to another user of the IT and security operations application, and wherein the input includes a user identifier of the another user. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the request includes data indicating one of a prompt, an action review, a workflow task, or a mention notification. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the request indicates a target completion time by which the response to the request is to be received by the IT and security operations application from the IT and security operations mobile application. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the interface elements for responding to the request includes an interface element used to designate a severity level to the request, and wherein the input in response to the request includes a designated severity level. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: causing display of a dashboard GUI including information about an IT and security operations instance associated with a user. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: causing display of an events GUI including information about one or more events detected within an IT and security operations instance associated with a user. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, further comprising: receiving input selecting an interface elements associated with a first status type of a plurality of status types, the plurality of status types including unassigned events, new events, in progress events, under review events, resolved events, and closed events; and causing display of an updated events GUI including information about one or more events detected within an IT and security operations instance associated with the first status type. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: causing display of a notifications GUI including information about one or more notifications generated for an IT and security operations instance associated with a user. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the executing workflow process is a defined set of actions in response to the incident identified by an IT and security operations application, and wherein the defined set of actions include at least one action requiring a user input. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the IT and security operations application executes in a provider network. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein the request is received by the IT and security operations mobile applications via a first secure connection established between a tunnel bridge and the IT and security operations mobile applications, and wherein the response to the request is transmitted to the IT and security operations application via the first secure connection. ### Claim 13 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising: receiving, by an information technology (IT) and security operations mobile application executing on a mobile device, a request related to an executing workflow process, wherein the executing workflow process relates to an incident identified by the IT and security operations application monitoring an IT environment; causing display of a graphical user interface (GUI) including interface elements for responding to the request; receiving, via the interface elements, input indicating a response to the request, wherein the response requests execution of a playbook to be used to respond to the incident; and transmitting, by the IT and security operations mobile application, the response to the request, wherein the response to the request causes execution of the playbook by the IT and security operations application. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the interface elements include a user delegation interface element used to delegate the request to another user of the IT and security operations application, and wherein the input includes a user identifier of the another user. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions, when executed by the processor, further cause the processor to perform operations including: causing display of an events GUI including information about one or more events detected within an IT and security operations instance associated with a user. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions, when executed by the processor, further cause the processor to perform operations including: causing display of a notifications GUI including information about one or more notifications generated for an IT and security operations instance associated with a user. ### Claim 17 A computing device, comprising: one or more processors; a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the computing device to: receive, by an information technology (IT) and security operations mobile application, a request related to an executing workflow process, wherein the executing workflow process relates to an incident identified by the IT and security operations application monitoring an IT environment; cause display of a graphical user interface (GUI) including interface elements for responding to the request; receive, via the interface elements, input indicating a response to the request, wherein the response requests execution of a playbook to be used to respond to the incident; and transmit, by the IT and security operations mobile application, the response to the request, wherein the response to the request causes execution of the playbook by the IT and security operations application. ### Claim 18 (depends on 17) The computing device of claim 17, wherein the interface elements include a user delegation interface element used to delegate the request to another user of the IT and security operations application, and wherein the input includes a user identifier of the another user. ### Claim 19 (depends on 17) The computing device of claim 17, wherein the instructions, when executed by the processor, further cause the processor to perform operations including: causing display of an events GUI including information about one or more events detected within an IT and security operations instance associated with a user. ### Claim 20 (depends on 17) The computing device of claim 17, wherein the instructions, when executed by the processor, further cause the processor to perform operations including: causing display of a notifications GUI including information about one or more notifications generated for an IT and security operations instance associated with a user.