Servicenow, Inc.

Asaf Garty

Robert Bitterfeld

Hail Tal

Daniel Badyan

Bary Solomon

Aviya Aron

Shay Herzog

Noam Biran

Tom Bar Oz

Boris Erblat

Haviv Rosh

Yuval Rimar

Alexandra Feiguine

Shiri Hameiri

Sreenevas Subramaniam

Aakash Umeshbhai Bhagat

Shimon Sant

Olga Zateikin

Baskar Jayaraman

Qingbin Li

Leonid Suslov

Yair Leibkowiz

Dinesh Kumar Kishorkumar Surapaneni

A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint. The operations further include, based on the comparing, determining a disparity between software applications installed on the particular computing device and the reference computing device, and storing, in the persistent storage, a representation of the disparity.

Determining application security and correctness using machine learning based clustering and similarity

A method includes obtaining a discovery pattern that indicates a plurality of operations associated with a corresponding computing resource type of a plurality of computing resource types. The method also includes identifying a variable parameter value associated with execution of the discovery pattern with respect to a computing resource of the corresponding computing resource type, and determining an error value by using a machine learning model to process the variable parameter value. The error value indicates a likelihood that execution of the discovery pattern, when associated with the variable parameter value, with respect to the particular computing resource results in a corresponding error type. The method further includes receiving, based on the error value, an input comprising one or more of (i) an instruction to execute the discovery pattern or (ii) a modification applicable to the variable parameter value.

Discovery troubleshooting based on machine learning

An embodiment may involve receiving an account identifier, wherein the account identifier is associated with a service account; transmitting a first API query to a remote computing system based on the account identifier; receiving first information associated with a first resource based on the first API query, wherein the first resource corresponds to a cloud orchestrator associated with a first service provided by the remote computing system; transmitting a first set of queries to the remote computing system based on the first information; receiving second information about a cluster of resources, associated with the first resource, based on the first set of queries, wherein a set of services related to the first service are deployed in one or more resources of the cluster of resources; generating a relationship map between the first resource and the cluster of resources based on the second information; and outputting the relationship map.

Automatic discovery of cloud-based infrastructure and resources

A computing system may include a database disposed within a remote network management platform that manages a managed network, and a software application associated with the platform. The software application may be configured to: obtain a unit of programmatic code from a third-party computing system, where the unit of programmatic code is hosted by the third-party computing system on behalf of the managed network, and where a program using the unit of programmatic code is executable by computing resources of the third-party computing system that are assigned on demand; parse the unit of programmatic code for a pattern indicative of respective relationships between the unit of programmatic code and service(s) provided by the third-party computing system; generate an association between the unit of programmatic code and the service(s); and store, in the database, representations of the unit of programmatic code, the service(s), and the association therebetween as discovered configuration items.

Discovery and service mapping of serverless resources

One or more parameters of one or more processes identified as belonging to a specific process grouping among a plurality of process groupings are obtained. Eligible token words in the one or more parameters are identified. The eligible token words are processed to select a subset within the eligible token words that are likely descriptive of the specific process grouping. The selected subset within the eligible token words is utilized to determine a descriptive identifier associated with the specific process grouping.

Automatically determining a descriptive identifier for a process grouping

A source computational instance may be configured to operate a software application and store a first set of content related to the software application. A target computational instance may be configured to operate the software application and store a second set of content related to the software application. The software application operated by the target computational instance may apply transformation rules to received content before storing the received content in the second set of content. The source computational instance may be further configured to receive selected content chosen from the first set of content and an indication of the target computational instance, and transmit the selected content to the target computational instance. The target computational instance may be further configured to receive the selected content, apply the transformation rules to the selected content, and store the selected content within the second set of content.

Synchronization between computational instances of a remote network management platform

A computing system includes a database and a discovery application that initiates discovery of software applications within a managed network by probing the computing devices for applications in stalled thereon. The discovery application executes discovery patterns in an attempt to classify a discovered application and determines that the discovered application is unclassified after executing the discovery patterns. In response to determining that the discovered application is unclassified, the discovery application (i) generates a configuration item representing the discovered application without classification and (ii) selects a characteristic file containing attributes of the discovered application. The discovery application provides the characteristic file to a machine learning (ML) classifier trained using a plurality of characteristic files. The discovery application receives, from the ML classifier, a classification of the discovered application, modifies the configuration item to include the classification of the discovered application, and stores, in the database, the configuration item as modified.

Identifying applications with machine learning

A computing system includes persistent storage configured to store representations of software applications that include textual data respectively indicative of attributes of the software applications, and a mapping application configured to perform operations. The operations include retrieving a representation corresponding to a software application and, based thereon, identifying character strings present within textual data associated therewith. The operations also include generating, for each character string, a corresponding weight based on a frequency of the character string within the particular textual data and a frequency of the character string within textual data associated with at least a subset of the software applications. The operations additionally include selecting, from the character strings and based on the corresponding weights, candidate tags for the particular software application. The operations further include generating a mapping between the software application and a computing resource based on the candidate tags, and storing a representation of the mapping.

Enhanced service mapping based on natural language processing

A computing system may include a database disposed within a remote network management platform that manages a managed network, and a software application associated with the platform and configured to: obtain, from an external computing system, information about a function-application arranged to execute source code segment(s) on demand; determine that the obtained information relates to (i) a plurality of authorization-keys each respectively arranged to authorize on-demand execution of one of the source code segments, (ii) a first key-value string pair that enables establishment of connectivity to a service of the external computing system or of another computing system, and/or (iii) a second key-value string pair that enables establishment of connectivity to a data source of the external computing system or of another computing system, and responsively determine association(s) between the source code segment(s), the function-application, the service, and/or the data source; and store the association(s) in the database.

Functional discovery and mapping of serverless resources

A discovery computing system may receive an account identifier (ID) and a set of credentials required to access a first service account. The discovery computing system may transmit a first API query to a remote computing system. The discovery computing system may receive an organization identifier (ID) of the organization from the remote computing system. The discovery computing system may further transmit a second API query to the remote computing system. The discovery computing system may be further configured to receive information about a set of projects, in the organization, from the remote computing system. The discovery computing system may further generate a set of service accounts and further determine the set of resources, in the remote computing system, associated with each of the generated set of service accounts. The discovery computing system may further store the determined set of resources, as configuration items in a persistent storage.

A regular expression that is able to be used to identify an item as belonging to a specific group among a plurality of different groups is determined. The regular expression is tested against a sampling of items known to belong to the specific group to determine a true positive metric. The regular expression is tested against a sampling of items known to belong to other groups among the plurality of different groups outside the specific group to determine a false positive metric. An accuracy metric of the determined regular expression is calculated based at least in part on the true positive metric and the false positive metric. The accuracy metric is provided for use in evaluating the regular expression.

Accuracy metric for regular expression

Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Discovery process identification and classification

A system may include persistent storage configured to store: a shared classification model including a plurality of classifiers based on training data from a plurality of managed networks, and a representation of a plurality of software applications executable computing devices within a particular managed network. The system may also include a discovery application configured to perform operations including obtaining attributes of a software process. The operations may also include determining, by way of the shared classification model and based on the attributes, a suggested classifier of the plurality of classifiers and determining, by way of the suggested classifier and based on the attributes, a suggested classification for the software process. The operations may further include receiving an indication that the suggested classification has been accepted, based on receiving the indication, updating the representation to indicate the suggested classification, and storing, in the persistent storage, the representation as updated.

Shared machine learning model for application discovery

A computing system includes a database and a discovery application. The discovery application obtains credentials for accessing a server hosting a software bus application which connects a plurality of applications within a managed network. The discovery application selects, based on a pattern corresponding to the software bus application, one or more files to access, transmits, to the server, instructions to access the one or more files, and receives therefrom data identifying a plurality of attributes of the software bus application. Based on this data, the discovery application transmits, to the server, instructions to identify communicative connections established between the plurality of software applications by way of the software bus application and receives therefrom data identifying the communicative connections. Based on (i) the plurality of attributes and (ii) the communicative connections, the discovery application generates a mapping that represents the communicative connections and stores the mapping in the database.

Growing community of inventors

Sdei Hemed, Israel

Asaf Garty