Splunk Inc.

Jeffrey Roecks

Ryan Connor Means

Taotao Yu

Ian Forrest

Matthew Hanson

Sydney Flak

Jeffery Roberts

Jacob Davis

Dekel Shahaff

Navya Mehta

Sydney Karimi

Elton Xue

Giulio Colleluori

Techniques are described for providing users of an IT and security operations application with the ability to enable the collection and display of playbook run statistics. Users can selectively enable the generation of playbook run statistics for individual playbooks. Once enabled for a playbook, the IT and security operations application automatically adds source code to the playbook or otherwise enables the collection of function block-level statistics during playbook executions. Users can view the statistics collected for a playbook to compare the performance of individual blocks against one another, to compare the performance of individual playbook runs against other playbook runs or against an average of all playbook runs, and so forth. The ability to obtain playbook run statistics enables users to learn how their playbooks are performing and to troubleshoot potential issues, thereby improving the performance of playbooks and the security and operation of the IT environments in which playbooks are deployed.

Generating playbook run statistics for playbooks executed by an information technology and security operations application

Techniques are described for providing a built-in 'app' editor for an information technology (IT) and security operations application that enables users to create, modify, and test operation of apps under development within the editor. Some IT and security operations applications enable users to extend the applications by adding connectivity to third party technologies to run custom actions. For example, a user might create a custom app to enable an IT and security operations application to connect to an external service providing information about malicious Internet Protocol (IP) addresses, to connect to a relevant cloud provider service, or to interact with a firewall or other type of computing device used in a user's computing environment. Given the broad set of technologies that can be orchestrated by an IT and security operations application, apps broadly enable users to add custom functionality to interface with virtually any technology of interest.

Live app testing within an app editor for an information technology and security operations application

A playbook execution architecture used to efficiently execute playbooks by distributing the execution of playbook function blocks to multiple independent 'worker' sub-processes is described. Each worker process hosts an independent execution environment used to execute playbook function blocks independently from other worker processes, where each worker process can host an execution environment that is the same as or different from execution environments hosted by other work processes, enabling the playbook execution engine to support function blocks written in multiple different programming language versions or programming languages entirely. The described playbook execution architecture enables an IT and security operations application to vertically scale the computing resources used to execute playbooks, provides users with more control over an amount of computing resources devoted to the execution of playbooks, and enables more expressiveness in the types of actions and efficiency of playbooks by providing support for multiple programming languages and programming language versions.

Information technology and security application automation architecture

Growing community of inventors

San Carlos, CA, United States of America

Jeffrey Roecks