Servicenow, Inc.

Bnayahu Makovsky

Dov Miron

Ofer Gati

Netta Hasdai

Yuval Rimar

Noam Biran

Adar Margalit

Kanwaldeep Kaur Dang

Yair Leibkowiz

Amit Arom-Zohar

Rani Tzur

Yotam Barak

Maayan Wigelman

Swapnesh Patel

Tal Kapon

Vadim Dukhovny

Ritika Goyal

Kiran Kumar Bushireddy

Anand Nikhil Mehta

Luc John Johnson

Shlomi Sividia

Jesus Castro

Mohammad Iktelat

Configuration management persistent storage contains entries representing configuration items and relationships between pairs of the configuration items. Event management persistent storage contains entries representing alert records. Change request persistent storage contains change records respectively referring to changes made to the configuration items. One or more processors may be configured to: extract, from a particular alert, a particular configuration item referred to therein that is associated with a particular problem; determine, by way of the relationships, a set of configuration items within a topological distance of the particular configuration item; identify, by way of the change records, one or more change requests that refer to any of the set of configuration items; and calculate root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert.

Context-aware automated root cause analysis in managed networks

Messages indicative of events are transmitted from a computer network to a management system using an agent device. The agent device receives a web service event collector from the management system. The web service event collector includes event message transformation instructions and an endpoint definition. After the web service event collector is initialized, an event message transmitted from an event source is received using the web service event collector. The event message indicates an event associated with the computer network. Using the event message transformation instructions, the event message is transformed into a format usable by the management system. The transformed event message is then transmitted to the management system.

Transformation and transmission of event messages

A method of managing alerts in a client instance associated with a configuration management database (CMDB) platform is disclosed. The method includes: receiving a request identifying a particular CI and a particular alert; identifying related CIs from a plurality of CIs associated with the client instance based on the particular CI and the particular alert; identifying alerts, incidents (INTs), changes (CHGs), and problems (PRBs) of the client instance that are associated with either the particular CI or the related CIs; determining frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and sending a response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs to be presented alongside the frequency data for the alerts, INTs, CHGs, PRBs associated with the related CIs.

System and method for alert insight in configuration management databases (CMDBs)

Systems and methods are provided for dynamic selection of anomaly detection options for particular metric data. Metric data corresponding to one or more configuration items of an information technology (IT) infrastructure is collected. A selected anomaly detection action option that applies to the metric data is identified. An action is performed using the metric data, based upon the selected anomaly detection action option. A dashboard graphical user interface (GUI) display results of the action.

Dynamic anomaly reporting

An alert management system for a configuration management database (CMDB) platform includes a client instance configured to: apply a first filter of an alert rule to CMDB alerts to select a first alert based on context of the first alert and apply a second filter of the alert rule to the CMDB alerts to select a second alert based on context of the second alert, wherein the context of the first and second alerts includes details regarding the first and second alerts and associated configuration items (CIs). The client instance is also configured to: evaluate at least one condition of the alert rule using the context of the first and/or second alert; and in response to evaluating the at least one condition of the alert rule to be true, performing at least one action of the alert rule using the context of the first and/or second alert.

Alert management system and method of using alert context-based alert rules

A new alert associated with a computer information technology issue to be remediated is received. Matching previous alerts similar to the new alert are determined. One or more successful remediation actions of the matching previous alerts are identified. The one or more successful remediation actions are evaluated. A performance of a selected one of the one or more successful remediation actions is initiated.

Computer information technology alert remediation selection based on alert similarity

An enterprise platform may include a time series database that may include time series data related to a plurality of configuration items associated with an enterprise. The enterprise platform may also include one or more instance data tables having instance data associated with the plurality of configuration items. The enterprise platform may also include an alert interface that may receive an indication of an alert associated with a configuration item of the plurality of configuration items and determine a subset of a plurality of metrics associated with the alert based on the configuration item and the time series data, the instance data, or both. The alert interface may then generate a plurality of visualizations for display via a user interface based on the subset of the plurality of metrics.

Alert intelligence integration

Techniques related to bulk mapping network services are disclosed. The techniques include a system, comprising non-transitory memory devices, and hardware processors configured to execute instructions from the non-transitory memory devices to cause the system to determine a set of service entry point candidates for an organization based, at least in part, on network information received from load balancing servers, receive user input including a selection of a set of service entry points selected from the set of service entry point candidates, collect network information related to two or more service entry points of the set of service entry point candidates in parallel, the network information including returned errors associated with a respective service entry point, group the returned errors into category groups based on characteristics of the returned errors, and display the category groups on a display device for bulk resolution.

Bulk service mapping

Events received from event sources are processed with respect to components of a computer network. Responsive to receiving an event, it is determined that the event is associated with an event rule based on criteria of the event rule. An alert is generated responsive to the event meeting an alert threshold of the event rule. The alert is then bound to a configuration item identified using at least one configuration item type and at least one configuration item attribute included in the event rule. The alert is enriched by adding one or more attributes of the configuration item to the alert according to enrichment criteria included in the event rule. The event rule is built using sequentially receiving user input. The event rule can be tested by applying the event rule to a plurality of test events. The event rule can be published for use in generating alerts.

System for processing events using event rules

A system includes a non-transitory memory and one or more hardware processors. The hardware processors are configured to read instructions from the non-transitory memory to perform operations including generating a service mapping illustrating a plurality of discovered configuration items connected to a network and one or more connections between the plurality of discovered configuration items, wherein at least one of the plurality of discovered configuration items comprises a virtual platform server, receiving input data from the generated service mapping associated with the virtual platform server, wherein the input data indicates one or more manual configuration item additions, validating the input data of the one or more manual configuration item additions, update the service mapping to include the one or more manual configuration item additions, generating a specified number of tasks to be performed by the service mapping, and determining an amount of time for the updated service mapping to respond to the set number of tasks.

Systems and methods for service mapping

A system includes a non-transitory memory and one or more hardware processors. The one or more hardware processors are configured to read instructions from the non-transitory memory to perform operations including generating a service mapping illustrating a plurality of tiles, wherein each of the plurality of tiles corresponds to one or more services in an enterprise network and one or more lines extending between the plurality of tiles, wherein the one or more lines correspond to connections between the plurality of services, wherein a first tile of the plurality of tiles corresponds to a first service comprising a plurality of sub-services not depicted in the service mapping, and displaying an alert on the first tile corresponding to the first service when one or more of the plurality of sub-services encounters an error.

Systems and method for service mapping

The present disclosure relates to a mobile application and interface for event management. The mobile application may have various, configurable features, such as different information that may be displayed, different actions that may be performed, and so forth, such that a given organization or user can be provided with configured or customized levels of function. A designer of the mobile application may configure or select certain features to be available to different users or classes of users, such as to remove a feature that is not relevant to a specific user or group of users.

Customizable mobile application for event management

A system may include a cloud service platform accessible by a client device via a client network. The cloud service platform may provide a graphical user interface (GUI) to the client device and receive an indication of one or more service records associated with an enterprise from a database and generate the GUI for display on the client devices. The GUI may have a services dashboard including one or more graphical icons representative of respective service records of the service records. The cloud service platform may also receive one or more user inputs indicative of an adjustment to an amount of graphical icons displayed in the services dashboard from the client device, and dynamically modify an appearance of the graphical icons based on the user inputs. The appearance of the graphical icons may be indicative of one or more types of data associated with the respective service records.

Growing community of inventors

Savyon, Israel

Bnayahu Makovsky