Splunk Inc.

Splunkinc.

Sydney Flak

Allison Lindsey Drake

Matthew Hanson

Daniel Trenker

Govinda Salinas

Philip Royer

Colin Fagan

Jeffery Roberts

Ian Forrest

Jacob Davis

Jeffrey Roecks

Dekel Shahaff

Navya Mehta

Sydney Karimi

Elton Xue

Techniques are described for enabling users of an information technology (IT) and security operations application to create highly reusable custom functions for playbooks. The creation and execution of playbooks using an IT and security operations application generally enables users to automate operations related to an IT environment responsive to the identification of various types of incidents or other triggering conditions. Users can create playbooks to automate operations such as, for example, modifying firewall settings, quarantining devices, restarting servers, etc., to improve users' ability to efficiently respond to various types of incidents operational issues that arise from time to time in IT environments.

Selecting a custom function from available custom functions to be added into a playbook

Techniques are described for providing a built-in 'app' editor for an information technology (IT) and security operations application that enables users to create, modify, and test operation of apps under development within the editor. Some IT and security operations applications enable users to extend the applications by adding connectivity to third party technologies to run custom actions. For example, a user might create a custom app to enable an IT and security operations application to connect to an external service providing information about malicious Internet Protocol (IP) addresses, to connect to a relevant cloud provider service, or to interact with a firewall or other type of computing device used in a user's computing environment. Given the broad set of technologies that can be orchestrated by an IT and security operations application, apps broadly enable users to add custom functionality to interface with virtually any technology of interest.

Live app testing within an app editor for an information technology and security operations application

Updating reusable custom functions across playbooks

Techniques are described for enabling users to add custom code function blocks and multi-prompt blocks to customizable playbooks that can be executed by an orchestration, automation, and response (OAR) platform. At a high level, a playbook comprises computer program code and possibly other data that can be executed by an OAR platform to carry out an automated set of actions. A playbook is comprised of one or more functions or codeblocks, where each codeblock contains program code that performs defined functionality when the codeblock is encountered during execution of the playbook of which it is a part. For example, a first codeblock may implement an action that is performed relative to one or more IT assets, another codeblock might filter data generated by the first codeblock in some manner, and so forth.

Executing playbooks including custom code function blocks

Reusable custom functions for playbooks

Executing playbooks including multi-prompt blocks

Multi-prompt blocks for a visual playbook editor

Growing community of inventors

Belmont, CA, United States of America

Sydney Flak