Abstract: The systems and techniques include storing topology from each of a plurality of source tools as a plurality of source subgraphs in a graph database using a source schema that mirrors a source topology model for each of the plurality of source tools. Each of the plurality of source subgraphs in the graph database is transformed to a plurality of destination subgraphs using a destination schema and transformation rules that mirror a destination topology model for each of a plurality of destination tools. The plurality of destination subgraphs are stored in the graph database. The topology is delivered to each of the plurality of destination tools by traversing the plurality of destination subgraphs in the graph database and invoking application programming interfaces (APIs) for each of the plurality of destination tools in the destination subgraphs in the graph database.

Abstract: An automated system is presented for unit testing an application in a mainframe execution environment. A plurality of stub objects reside in the mainframe execution environment, such that each stub object in the plurality of stub objects represents a different stub type. A command translator table is configured with an entry for each command available for an online transaction processor. Each entry in the command translator table specifies a stub type for the command and includes a listing of possible arguments associated with the given command, such that each possible argument in the listing of possible arguments has a specified category type. A test configurator executes in the mainframe execution environment and is configured to receive and parse a test input file. A setup routine interacts with the test configurator to receive records from the test input file.

Abstract: Large numbers of files having widely varying structures and formats may be ingested, and used to generate dynamic slot indexes that enable fast and reliable searching of the files. Unique data patterns within the files are used to generate unique pattern models, which enable model-specific mappings of file fields to slots of a dynamic slot index. Accordingly, the dynamic slot indexes may reuse a single slot for multiple fields. Complex queries may then be processed in a time-efficient and resource-efficient manner, even when rapidly ingesting huge numbers of files having indeterminate data patterns from many different sources.

Abstract: Systems and techniques for identifying performance issues and recommending actions during design-time application development include receiving a design-time user interface (UI) having multiple fields associated with data from a database, where the multiple fields including one or more types of fields. In response to receiving a trigger, the systems and techniques iterate through the multiple fields in the design-time UI by applying one or more rules related to the types of fields and cardinality of the data from the database. One or more recommendations are generated for one or more of the fields based on the applied rules to the multiple fields and the recommendations are output to a display. The systems and techniques may include changing the design-time UI without user input using the recommendations.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: When a restart event is detected within a technology landscape, restart-impacted performance metrics and non-restart-impacted performance metrics may be identified. The non-restart-impacted performance metrics may continue to be included within a performance characterization of the technology landscape. The restart-impacted performance metrics may be monitored, while being excluded from the performance characterization. The restart-impacted performance metric of the restart-impacted performance metrics may be transitioned to a non-restart-impacted performance metric, based on a monitored value of the restart-impacted performance metric following the restart event.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: A plurality of resolved incident tickets may each include a worklog providing a history of actions taken during attempts to resolve a corresponding resolved incident and a resolution having at least one resolution statement. An iterative processing of the plurality of resolved incident tickets may include processing each resolution statement of the resolution with at least one domain-specific statement classifier specific to the incident domain to either discard or retain a classified resolution statement; processing each retained classified resolution statement in conjunction with the worklog to determine whether to discard or retain the resolved incident; providing an updated resolution for the resolved incident when the resolved incident is retained, and adding the resolved incident with the updated resolution to the processed incident tickets. Then, at least one machine learning model may be trained to process a new incident ticket, using the processed incident tickets.

Abstract: Described systems and techniques determine causal associations between events that occur within an information technology landscape. Individual situations that are likely to represent active occurrences requiring a response may be identified as causal event clusters, without requiring manual tuning to determine cluster boundaries. Consequently, it is possible to identify root causes, analyze effects, predict future events, and prevent undesired outcomes, even in complicated, dispersed, interconnected systems.

Abstract: According to one general aspect, a non-transitory computer readable medium includes instructions that, when executed by at least one processor, cause a computing device to read a string of a log file for an application, where the log file comprises multiple strings of log data, compare the string to signatures stored in a memory to find a matching signature, where each of the signatures is encoded with a signature identifier (ID), determine a deviation between the string and the matching signature, encode the string with the signature identifier (ID) of the matching signature and the deviation, and transfer the string to a destination computing device using the signature identifier (ID) of the matching signature, the deviation, and a timestamp of the string.

Abstract: A method for determining a misconfiguration of components in an Information Technology (IT) infrastructure includes decomposing one or more components into sub parts, creating one or more synthetic objects, each synthetic object being associated with a sub part of a respective component, and including the components and the synthetic objects in a model of the IT infrastructure. The method further determines a relationship between a first component and a first synthetic object based on attributes of the first component and attributes of the first synthetic object, includes the determined relationship in the model of the IT infrastructure, and loads a graph of the IT infrastructure in a graph database with the first component and the synthetic object as nodes and the determined relationship as an edge in the graph. The method further determines the misconfiguration of components in the IT infrastructure by identifying components having improper relationships in the graph.

Abstract: A computer-implemented method is presented for reporting application programs linked to by an application running under an online transaction processor of a mainframe computing environment. An intercept program is implanted in an address space of the online transaction processor. A task executing outside of the address space of the online transaction processor identifies an address for a target domain gate program supported in a domain by the online transaction processor; identifies an address for an unused domain gate program supported in the domain by the online transaction processor; replaces the address for the unused domain gate program with the address for the target domain gate program; and replaces the address for the target domain gate program with an address for the intercept program.

Abstract: Described systems and techniques enable prediction of a state of an application at a future time, with high levels of accuracy and specificity. Accordingly, operators may be provided with sufficient warning to avert poor user experiences. Unsupervised machine learning techniques may be used to characterize current states of applications and underlying components in a standardized manner. The resulting data effectively provides labelled training data that may then be used by supervised machine learning algorithms to build state prediction models. Resulting state prediction models may then be deployed and used to predict an application state of an application at a specified future time.

Abstract: A method for securing a service implemented on a computer network includes identifying network assets in the computer network used by the service. The method further includes identifying vulnerabilities in one or more of the network assets, determining an asset risk score for each of the network assets, and determining a service risk score for the service. The method involves implementing one or more vulnerability remediation actions on the computer network to reduce the service risk score and secure the service.

Abstract: A computer system for behavioral analytics of native Information Technology Service Management (ITSM) incident handling data includes a processor, a memory, a de-normalized target data source for behavioral analysis, a transformation processor, and a statistical processor. The transformation processor reads an identified portion of the ITSM data and creates new normalized fields for the de-normalized target data source by parsing selected text fields from the portion of ITSM data. The created new normalized fields include a working group field and an associated support level field. The transformation processor further creates new de-normalized aggregation fields for the incipient de-normalized target data source based on the newly created normalized fields. The newly created de-normalized aggregation fields include fields characterizing incident handling behavior. A statistical processor further processes target data for behavioral analytics.

Abstract: An event graph schema for a technology landscape may be determined, where the technology landscape is characterized using scores assigned to performance metrics. The event graph schema may include a plurality of nodes corresponding to the performance metrics and the scores, and directional edges connecting node pairs of the plurality of nodes, with each directional edge having a score-dependent validity criteria defined by scores of a corresponding node pair. Anomalous scores associated with an event within the technology landscape may be used to find anomalous nodes. Valid edges connecting two of the anomalous nodes and satisfying the score-dependent validity criteria thereof may be used to determine at least one path that includes the valid edges and connected anomalous nodes. In this way, it is possible to traverse the at least one path to identify at least one of the connected anomalous nodes as a root cause node of the event.

Abstract: A method for securing a networked computer system executing an application includes identifying a vulnerable computer resource in the networked computer system, determining all computer resources in the networked computer system that are accessible from, or are accessed by, the vulnerable computer resource, and prioritizing implementation of a remediation action to secure the vulnerable computer resource if a vulnerability path extends from the vulnerable computer resource to a critical computer resource that contains sensitive information. The remediation action to secure the vulnerable computer resource is a safe remediation action that does not impact availability of the application executing on the networked computer system.

Abstract: Performance data characterizing operations of an application may be collected by time interval, and a plurality of keys may be associated with each element of the performance data. A first time interval may be received. An iterative group-and-filter search may be executed against the keyed elements within the first time interval, each iteration including an iteration key used to perform a key-based grouping operation followed by a group-based filter operation, wherein each iteration key is added to a composite key at each iteration. A selection of at least one keyed element within the first time interval and obtained from the iterative group-and-filter search may be received. A second time interval that precedes the first time interval may be received, and the keyed elements may be filtered using the composite key and within the second time interval to return the at least one keyed element within the second time interval.

Abstract: A cloud-native proxy gateway is reachable from a central server and from an isolated cloud VM. A method allows legacy (non-cloud native) solutions to establish a secure connection to the isolated cloud VM, even when incoming port flows are not enabled. The method involves transforming a TCP/IP network connection request into a cloud API call, ignoring IP addresses, and instead using a unique cloud resource identifier as the primary network routing methodology. In response to a communication connection request by the central server, the isolated VM establishes a reverse tunnel to the cloud-native proxy gateway. Communication flow initiated by the central server proceeds through the reverse tunnel to the isolated VM, avoiding an issue of duplicate IP addresses in the cloud.

Abstract: Described systems and techniques enable the intake of large numbers of files having widely varying structures and formats, as well as generation of dynamic slot indexes that enable fast and reliable searching of the files. Unique data patterns within the files are used to generate unique pattern models, which enable model-specific mappings of file fields to slots of a dynamic slot index. Accordingly, the dynamic slot indexes may reuse a single slot for multiple fields. Complex queries may then be processed in a time-efficient and resource-efficient manner, even when rapidly ingesting huge numbers of files having indeterminate data patterns from many different sources.