Servicenow, Inc.

Brian James Waplington

David Victor Barkovic

Naveen Reddy Bojja

Giora Tamir

Santosh Reddy Poreddy

Vamsi Krishna Madala

Hemendra Rana

Thomas Woodley Brotherton

Kurt Zettel

Maulik Shah

Swapnesh Patel

Ravindra Bansal

Xuchang Chen

Michael Steven Ludwig

Benny Van De Sompele

Alexander House

Venkata Siva Sankar Alampalle

Tamir Livneh

Karthika Gajjala

Saipraneeth Muddana

Hyung Kim

An example embodiment may involve determining that a configuration item has failed identification, wherein the configuration item represents computing hardware or software associated with a network; based on the configuration item failing identification, performing a reconciliation procedure, wherein the reconciliation procedure modifies an attribute of the configuration item; determining that the configuration item as modified passes identification; and writing, to a database, the configuration item as modified.

Reconciliation of partial configuration items

A system could include a first set of mappings between application files and version indicators. The application files could be related to a software application. The system could also include a second set of mappings between application files and a first subset of version indicators, where a standardized release of the software application includes application file versions in accordance with the first subset. The system could further include a third set of mappings between a second subset of version indicators and records indicating that the corresponding application file versions were written after the standardized release. The system could further include processors configured to perform operations including: determining that an application file in the third set of mappings has standardized release version. The operations could further include providing a difference between a recent version of the application file and the application file version that was part of the standardized release.

Automatic determination of code customizations

A controller computing device may include one or more processors and memory containing controller data representing controller computing device capabilities. The one or more processors may be configured to transmit on a first instance of a request-response protocol, a controller request, including the controller data, to an agent computing device. The controller computing device may then receive, from the agent computing device, an agent request on a second instance of the request-response protocol. The agent request may include agent data representing agent computing device capabilities. The controller computing device may store the agent data in the memory, and transmit on the second instance of the request-response protocol, to the agent computing device, a controller response acknowledging receipt of the agent request. The controller computing device may then receive on the first instance of the request-response protocol from the agent computing device, an agent response acknowledging receipt of the controller request.

Nested request-response protocol network communications

An embodiment may involve receiving, at a web server application, a query specifying a file, a block number of a block of data within the file, and a block size, wherein the file includes entries representing differences between snapshots of configuration data; identifying, based on the block size, the block of data within the file; storing the block in a non-transitory memory that is accessible to the web server application; and in response to the query, transmitting, by the web server application, a set of the entries within the block formatted for display in a list component of a graphical user interface.

Computationally efficient traversal of virtual tables

Persistent storage may contain: (i) an explicit configuration item table with entries of explicit configuration items representing hardware devices and executable software applications deployed on the hardware devices, (ii) an implicit configuration item table with entries of implicit configuration items representing units of source code, wherein at least some of the executable software applications are compiled versions of the units of source code, and (iii) an implicit relationship table associating pairs of the configuration items. One or more processors may be configured to receive information related to a particular unit of source code; write, to the implicit configuration item table, at least some of the information as an implicit configuration item; determine that the implicit configuration item has one or more identifying attributes in common with an explicit configuration item; and write, to the implicit relationship table, a new entry associating the implicit configuration item and the explicit configuration item.

Representing source code as implicit configuration items

An embodiment may involve, in response to determining that a software service satisfies a degradation criterion, generating an alert that indicates the software service and a change request specifying that configuration data used by the software service was changed in a current snapshot of the configuration data; based on the change request, determining a set of configuration changes between the current snapshot and a previous snapshot of the configuration data; and providing a representation of the set of configuration changes indicating one or more parameters that were changed in the current snapshot and one or more paths in a tree-based arrangement of the configuration data that lead to the one or more parameters that were changed in the current snapshot.

Centralized configuration and change tracking for a computing platform

A correlation request is received at a first application instance from a second application instance for a data record of the first application instance. A correlation index is updated with a directional correlation entry in response to a determination that the correlation request is approved. In response to determining that the data record has been modified, the updated correlation index is utilized to determine that the modified data record is to be provided for correlation to the second application instance. A version of the modified data record is provided to the second application instance.

Data record correlation and migration

A machine learning model is trained based at least on previous change requests, wherein each of the previous change requests are associated with a controlled management of a lifecycle of a change to an information technology environment. A security vulnerability of the information technology environment is identified. Using the trained machine learning model, a corresponding match score for each of a plurality of pending change requests is determined for the security vulnerability. An indication of whether a resolution specification for the security vulnerability is to be linked with one of the plurality of pending change requests selected based on a factor associated with its corresponding match score is received.

Automatic identification of change requests to address information technology vulnerabilities

An embodiment may involve a plurality of configuration items and an unmatched configuration item, wherein the unmatched configuration item is associated with a first set of attribute values and a first vulnerability, wherein the first vulnerability is associated with a first set of field values. The embodiment may further involve one or more processors configured to: (i) determine that the unmatched configuration item and a particular configuration item both represent a specific component, wherein the particular configuration item is associated with a second set of attribute values and a second vulnerability, wherein the second vulnerability is associated with a second set of field values; (ii) merge the unmatched configuration item into the particular configuration item; (iii) determine that the first vulnerability and the second vulnerability both represent a specific vulnerability; (iv) merge the first vulnerability into the second vulnerability; and (v) delete the unmatched configuration item and the first vulnerability.

Merging duplicate items identified by a vulnerability analysis

Solution management systems and methods are presently disclosed that enable receiving, compiling, and analyzing vendor solutions, determining the vendor solutions that address a target vulnerability of a client network and/or client devices, determining additional vulnerabilities of the client network and/or client devices that the vendor solutions address, and selecting a vendor solution to remediate the target vulnerability. The presently disclosed systems and methods also enable scoring, risk evaluation, and additional metrics to facilitate determining the vendor solution(s) that have the largest impact and/or benefit to the various vulnerabilities of the client network and/or client devices.

Solution management systems and methods for addressing cybersecurity vulnerabilities

A vulnerability-solution resolution (VSR) system is disclosed that is designed to create and maintain associations between vulnerabilities identified by third-party scanners (TPSs) and solutions, such as software patches received from third-party vendors. The VSR system includes a data scheme that enables information regarding vulnerabilities and solutions to be stored, and enables certain relationships to be automatically created between these vulnerabilities and solutions. In particular, the VSR system is designed to automatically form certain relationships between particular vulnerabilities and solutions based on solution supersedence and inheritance. Additionally, the VSR system includes a graphical user interface (GUI) that enables a user to exclude particular relationships from consideration when recommending solutions to resolve a vulnerability or when calculating metrics regarding the vulnerability.

System and method for solution resolution for vulnerabilities identified by third-party vulnerability scanners

A system includes persistent storage containing configuration items (CIs) representing discovered attribute values of computing resources associated with a managed network, and an application configured to perform operations, including obtaining test result data generated based on a third-party scanning system executing tests of a particular computing resource associated with the managed network. The test result data includes attribute values of the particular computing resource. The operations also include generating, by way of an embedding model and based on the attribute values, an embedding vector representing the attribute values, and comparing the embedding vector to a plurality of candidate embedding vectors, each representing the discovered attribute values of a corresponding CI of the CIs. The operations further include, based on comparing the embedding vector to the plurality of candidate embedding vectors, selecting a particular CI of the CIs, and updating the particular CI to additionally represent the test result data.

Matching configuration items with machine learning

Systems and methods are disclosed that predict whether a configuration item of a service provider cloud infrastructure client instance has a vulnerability, prior to scanning for the client instance for the vulnerability. In particular, operating system and/or application information of the vulnerability may be compared to that of the configuration item, operating system and/or application information of past vulnerabilities may be compared to that of the vulnerability, additional vulnerabilities that are solved by solutions that remedy the vulnerability may be compared to the configuration, and/or a machine-learning model may be trained to determine how similar past vulnerabilities of the configuration item are to the vulnerability. Based on one or more of these comparisons, a predicted vulnerable item may be generated that indicates that the configuration item is subject to the vulnerability.

Growing community of inventors

San Diego, CA, United States of America

Brian James Waplington