Servicenow, Inc.

Qingbin Li

Stephen Scott Tucker

Purushottam Shridhar Amradkar

Kanwaldeep Kaur Dang

Robert Bitterfeld

Asaf Garty

Hail Tal

Yuval Rimar

Sreenevas Subramaniam

James Crotinger

Leonid Suslov

Brian Robert Silverstein

Dariush Shahgoshtasbi

Darren Hou

Yujie Fang

Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Discovery process identification and classification

A computing system and method for remote monitoring and forecasting of performance of a managed network is disclosed. The computing system may be disposed within a remote network management platform and be configured for monitoring respective performance of each of a plurality of network entities of the managed network. For each network entity, an alert may be issued in response to determining that the monitored respective performance is below a respective threshold performance level. Based on analysis of a group of alerts, a likelihood may be determined that a different alert will be issued for the monitored performance of a particular network entity of the plurality for which no respective alert has yet been issued. In response to the likelihood exceeding a threshold, an alert prediction for the performance of the particular network entity may be issued together with a score corresponding to the likelihood.

Operational analytics in managed networks

A computing device is provided that is configured to obtain, from a managed network, a plurality of response times of a network-based service provided by the managed network; to train, based on the plurality of response times, a probability distribution to model the managed network; to receive an additional response time from the managed network; to use the probability distribution to determine, for the additional response time, a percentile based on the additional response time; based on the percentile, to determine that the additional response time is anomalously high with respect to the plurality of response times of the network-based service; and to transmit, to a client device associated with the managed network, an indication that the additional response time is anomalously high. The probability distribution includes a central portion based on a plurality of bins and a tail portion based on a parametric distribution.

Hybrid anomaly detection for response-time-based events in a managed network

Systems and methods are disclosed for network event grouping. For example, methods may include generating a graph including vertices and edges, wherein at least one of the vertices is associated with an event type from a set of event types and wherein at least one of the edges is associated with a weight; removing, based on an associated weight and a first threshold, one or more edges from the graph; determining, after removing the one or more edges from the graph, whether the graph is chordal; responsive to determining that the graph is chordal, identifying a connected subgraph within the graph; determining a group of event types to include event types that are associated with vertices in the identified connected subgraph; and transmitting, storing, or displaying data specifying the group of event types.

Network event grouping

A system includes a non-transitory memory and a hardware processors configured to perform operations including receiving a plurality of events from one or more network monitoring systems, wherein each event includes a message output by a network monitoring system communicating a status of a network resource connected to a network, clustering similar events into one or more event clusters, extracting an event template for each event cluster, extracting a regular expression (regex) for each event cluster, grouping the events into one or more groups of events having the same or similar extracted regexes, and outputting the one or more groups of events.

Systems and method for event parsing

Growing community of inventors

Seattle, WA, United States of America

Qingbin Li