Servicenow, Inc.

Robert Bitterfeld

Asaf Garty

Hail Tal

Bary Solomon

Aviya Aron

Daniel Badyan

Boris Erblat

Tom Bar Oz

Alexandra Feiguine

Noam Biran

Shay Herzog

Shiri Hameiri

Aakash Umeshbhai Bhagat

Sreenevas Subramaniam

Shimon Sant

Naveen Kumar Hr

Olga Zateikin

Venkatesh Ainalli

Baskar Jayaraman

Yuval Rimar

Qingbin Li

Leonid Suslov

Arik Sityon

Tal Epshtein

Yair Leibkowiz

Dinesh Kumar Kishorkumar Surapaneni

Roy Wallerstein

Atul Gupta

Shruti Jain

Noy Shpatz

Barel Mengel

Dov Harel

Priyanka Goel

Darshan Ghanalinga Murthy

A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint. The operations further include, based on the comparing, determining a disparity between software applications installed on the particular computing device and the reference computing device, and storing, in the persistent storage, a representation of the disparity.

Determining application security and correctness using machine learning based clustering and similarity

Data communication between a plurality of computer processes are tracked. Relationships between the plurality of computer processes are classified including by analyzing the data communication between the plurality of computer processes using a machine learning model. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered.

Automatic service discovery

One or more parameters of one or more processes identified as belonging to a specific process grouping among a plurality of process groupings are obtained. Eligible token words in the one or more parameters are identified. The eligible token words are processed to select a subset within the eligible token words that are likely descriptive of the specific process grouping. The selected subset within the eligible token words is utilized to determine a descriptive identifier associated with the specific process grouping.

Automatically determining a descriptive identifier for a process grouping

A mock server implementation for discovery applications is provided. A computing system includes a mock server, which receives a client request from a mock client on a discovery server. The client request corresponds to a user query associated with a discovery of resources on a remote computing system. The mock server determines a first response from a mock response dataset. The first response to the client request is determined based on the received client request. The mock response dataset includes a set of responses associated with a sequence of operations executed in the past for the discovery of resources on the remote computing system. The mock server transmits the determined first response to the mock client on the discovery server. The mock client receives the transmitted first response and sends the received first response to a discovery application interface on a user device.

Implementation of a mock server for discovery applications

A computing system includes a database and a discovery application. The discovery application obtains credentials for accessing a server hosting a software bus application which connects a plurality of applications within a managed network. The discovery application selects, based on a pattern corresponding to the software bus application, one or more files to access, transmits, to the server, instructions to access the one or more files, and receives therefrom data identifying a plurality of attributes of the software bus application. Based on this data, the discovery application transmits, to the server, instructions to identify communicative connections established between the plurality of software applications by way of the software bus application and receives therefrom data identifying the communicative connections. Based on (i) the plurality of attributes and (ii) the communicative connections, the discovery application generates a mapping that represents the communicative connections and stores the mapping in the database.

Discovery of database and related services

A computing system includes a database and a discovery application that initiates discovery of software applications within a managed network by probing the computing devices for applications in stalled thereon. The discovery application executes discovery patterns in an attempt to classify a discovered application and determines that the discovered application is unclassified after executing the discovery patterns. In response to determining that the discovered application is unclassified, the discovery application (i) generates a configuration item representing the discovered application without classification and (ii) selects a characteristic file containing attributes of the discovered application. The discovery application provides the characteristic file to a machine learning (ML) classifier trained using a plurality of characteristic files. The discovery application receives, from the ML classifier, a classification of the discovered application, modifies the configuration item to include the classification of the discovered application, and stores, in the database, the configuration item as modified.

Identifying applications with machine learning

A computing system includes persistent storage configured to store representations of software applications that include textual data respectively indicative of attributes of the software applications, and a mapping application configured to perform operations. The operations include retrieving a representation corresponding to a software application and, based thereon, identifying character strings present within textual data associated therewith. The operations also include generating, for each character string, a corresponding weight based on a frequency of the character string within the particular textual data and a frequency of the character string within textual data associated with at least a subset of the software applications. The operations additionally include selecting, from the character strings and based on the corresponding weights, candidate tags for the particular software application. The operations further include generating a mapping between the software application and a computing resource based on the candidate tags, and storing a representation of the mapping.

Enhanced service mapping based on natural language processing

A computing system may include a database disposed within a remote network management platform that manages a managed network, and a software application associated with the platform and configured to: obtain, from an external computing system, information about a function-application arranged to execute source code segment(s) on demand; determine that the obtained information relates to (i) a plurality of authorization-keys each respectively arranged to authorize on-demand execution of one of the source code segments, (ii) a first key-value string pair that enables establishment of connectivity to a service of the external computing system or of another computing system, and/or (iii) a second key-value string pair that enables establishment of connectivity to a data source of the external computing system or of another computing system, and responsively determine association(s) between the source code segment(s), the function-application, the service, and/or the data source; and store the association(s) in the database.

Functional discovery and mapping of serverless resources

A discovery computing system may receive an account identifier (ID) and a set of credentials required to access a first service account. The discovery computing system may transmit a first API query to a remote computing system. The discovery computing system may receive an organization identifier (ID) of the organization from the remote computing system. The discovery computing system may further transmit a second API query to the remote computing system. The discovery computing system may be further configured to receive information about a set of projects, in the organization, from the remote computing system. The discovery computing system may further generate a set of service accounts and further determine the set of resources, in the remote computing system, associated with each of the generated set of service accounts. The discovery computing system may further store the determined set of resources, as configuration items in a persistent storage.

Automatic discovery of cloud-based infrastructure and resources

A regular expression that is able to be used to identify an item as belonging to a specific group among a plurality of different groups is determined. The regular expression is tested against a sampling of items known to belong to the specific group to determine a true positive metric. The regular expression is tested against a sampling of items known to belong to other groups among the plurality of different groups outside the specific group to determine a false positive metric. An accuracy metric of the determined regular expression is calculated based at least in part on the true positive metric and the false positive metric. The accuracy metric is provided for use in evaluating the regular expression.

Accuracy metric for regular expression

Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Discovery process identification and classification

A system may include persistent storage configured to store: a shared classification model including a plurality of classifiers based on training data from a plurality of managed networks, and a representation of a plurality of software applications executable computing devices within a particular managed network. The system may also include a discovery application configured to perform operations including obtaining attributes of a software process. The operations may also include determining, by way of the shared classification model and based on the attributes, a suggested classifier of the plurality of classifiers and determining, by way of the suggested classifier and based on the attributes, a suggested classification for the software process. The operations may further include receiving an indication that the suggested classification has been accepted, based on receiving the indication, updating the representation to indicate the suggested classification, and storing, in the persistent storage, the representation as updated.

Shared machine learning model for application discovery

The present disclosure relates generally to a system and method for synchronizing updates. A first cloud-based system may be embodied in a multi-instance or multi-tenant framework, and may provide for certain computing systems and configuration items. The first cloud-based system may include a probe system configured to retrieve a list of events from a second cloud computing system, wherein the list of events is representative of updates to resources provided by the second cloud computing system. The first cloud-based system may additionally include a sensor system configured to process the list of events to retrieve a payload for each event in the list of events. An update system may then update an updatable system included in the first cloud computing system based on the payload.

Systems and methods for cloud resource synchronization

Identifications of program processes executing on an information technology environment are received. The identified program processes are clustered into a plurality of different groups. Identifications of interactions between at least a portion of the program processes are received. The identified interactions are analyzed to determine one or more interaction metrics between different group pairs in the plurality of different groups. A graph representation that includes at least a portion of the plurality of different groups as graph nodes in the graph representation is generated. The graph representation includes one or more graph edges determined to be included based on the one or more interaction metrics.

Growing community of inventors

Petach Tikva, Israel

Robert Bitterfeld