Splunk Inc.

Ryan Connor Means

Sourabh Satish

Govind Salinas

Atif Mahadik

Jeffrey Roecks

Taotao Yu

Matthew Hanson

Jeffery Roberts

Giulio Colleluori

Techniques are described for providing users of an IT and security operations application with the ability to enable the collection and display of playbook run statistics. Users can selectively enable the generation of playbook run statistics for individual playbooks. Once enabled for a playbook, the IT and security operations application automatically adds source code to the playbook or otherwise enables the collection of function block-level statistics during playbook executions. Users can view the statistics collected for a playbook to compare the performance of individual blocks against one another, to compare the performance of individual playbook runs against other playbook runs or against an average of all playbook runs, and so forth. The ability to obtain playbook run statistics enables users to learn how their playbooks are performing and to troubleshoot potential issues, thereby improving the performance of playbooks and the security and operation of the IT environments in which playbooks are deployed.

Generating playbook run statistics for playbooks executed by an information technology and security operations application

Described herein are improvements for generating courses of action for an information technology (IT) environment. In one example, a method includes identifying a first course of action for responding to an incident type in an information technology environment and generating a simulated incident associated with the incident type. The method further includes initiating performance of the first course of action based on the generation of the simulated incident. The method also includes, upon reaching a particular step of the first course of action that prevents the performance of the first course of action from proceeding, providing a first simulated result that allows the performance of the first course of action to proceed.

Obtaining simulated results for a course of action executed in an information technology environment

A playbook execution architecture used to efficiently execute playbooks by distributing the execution of playbook function blocks to multiple independent 'worker' sub-processes is described. Each worker process hosts an independent execution environment used to execute playbook function blocks independently from other worker processes, where each worker process can host an execution environment that is the same as or different from execution environments hosted by other work processes, enabling the playbook execution engine to support function blocks written in multiple different programming language versions or programming languages entirely. The described playbook execution architecture enables an IT and security operations application to vertically scale the computing resources used to execute playbooks, provides users with more control over an amount of computing resources devoted to the execution of playbooks, and enables more expressiveness in the types of actions and efficiency of playbooks by providing support for multiple programming languages and programming language versions.

Information technology and security application automation architecture

Simulating multiple paths of a course of action executed in an information technology environment

Simulated incident response using simulated result when actual result is unavailable

Growing community of inventors

San Jose, CA, United States of America

Ryan Connor Means