Abstract: An example embodiment may involve requesting and receiving, from a distributed computing platform, resource indicators that specify a set of resources provided by the distributed computing platform, wherein the set of resources is associated with a user identifier; parsing the resource indicators to locate datacenter indicators in the set of resources, wherein the datacenter indicators identify in-use datacenters of the distributed computing platform; and performing pattern-based discovery, within the in-use datacenters, of computing resources of the distributed computing platform that are associated with the user identifier.

Abstract: An example embodiment may involve requesting and receiving, from a distributed computing platform, resource indicators that specify a set of resources provided by the distributed computing platform, wherein the set of resources is associated with a user identifier; parsing the resource indicators to locate datacenter indicators in the set of resources, wherein the datacenter indicators identify in-use datacenters of the distributed computing platform; and performing pattern-based discovery, within the in-use datacenters, of computing resources of the distributed computing platform that are associated with the user identifier.

Abstract: A method includes obtaining a discovery pattern that indicates a plurality of operations associated with a corresponding computing resource type of a plurality of computing resource types. The method also includes identifying a variable parameter value associated with execution of the discovery pattern with respect to a computing resource of the corresponding computing resource type, and determining an error value by using a machine learning model to process the variable parameter value. The error value indicates a likelihood that execution of the discovery pattern, when associated with the variable parameter value, with respect to the particular computing resource results in a corresponding error type. The method further includes receiving, based on the error value, an input comprising one or more of (i) an instruction to execute the discovery pattern or (ii) a modification applicable to the variable parameter value.

Abstract: A method and system for detecting malicious activities in an IT infrastructure, determining its impact to the IT infrastructure, and determining the associated remedial actions are disclosed. Data communication between a plurality of computer processes is tracked. At least one process of the plurality of computer processes is identified as an anomalous process with respect to at least some of the plurality of computer processes. A first computer process of the plurality of computer processes that is affected by the anomalous computer process is identified based on at least a portion of the tracking. An indication of the identified first computer process that is affected by the anomalous computer process is provided.

Abstract: A method includes obtaining a discovery pattern that indicates a plurality of operations associated with a corresponding computing resource type of a plurality of computing resource types. The method also includes identifying a variable parameter value associated with execution of the discovery pattern with respect to a computing resource of the corresponding computing resource type, and determining an error value by using a machine learning model to process the variable parameter value. The error value indicates a likelihood that execution of the discovery pattern, when associated with the variable parameter value, with respect to the particular computing resource results in a corresponding error type. The method further includes receiving, based on the error value, an input comprising one or more of (i) an instruction to execute the discovery pattern or (ii) a modification applicable to the variable parameter value.

Abstract: An embodiment may involve receiving an account identifier, wherein the account identifier is associated with a service account; transmitting a first API query to a remote computing system based on the account identifier; receiving first information associated with a first resource based on the first API query, wherein the first resource corresponds to a cloud orchestrator associated with a first service provided by the remote computing system; transmitting a first set of queries to the remote computing system based on the first information; receiving second information about a cluster of resources, associated with the first resource, based on the first set of queries, wherein a set of services related to the first service are deployed in one or more resources of the cluster of resources; generating a relationship map between the first resource and the cluster of resources based on the second information; and outputting the relationship map.

Abstract: An example embodiment may involve requesting and receiving, from a distributed computing platform, resource indicators that specify a set of resources provided by the distributed computing platform, wherein the set of resources is associated with a user identifier; parsing the resource indicators to locate datacenter indicators in the set of resources, wherein the datacenter indicators identify in-use datacenters of the distributed computing platform; and performing pattern-based discovery, within the in-use datacenters, of computing resources of the distributed computing platform that are associated with the user identifier.

Abstract: A computing system may include a database disposed within a remote network management platform that manages a managed network, and a software application associated with the platform. The software application may be configured to: obtain a unit of programmatic code from a third-party computing system, where the unit of programmatic code is hosted by the third-party computing system on behalf of the managed network, and where a program using the unit of programmatic code is executable by computing resources of the third-party computing system that are assigned on demand; parse the unit of programmatic code for a pattern indicative of respective relationships between the unit of programmatic code and service(s) provided by the third-party computing system; generate an association between the unit of programmatic code and the service(s); and store, in the database, representations of the unit of programmatic code, the service(s), and the association therebetween as discovered configuration items.

Abstract: One or more parameters of one or more processes identified as belonging to a specific process grouping among a plurality of process groupings are obtained. Eligible token words in the one or more parameters are identified. The eligible token words are processed to select a subset within the eligible token words that are likely descriptive of the specific process grouping. The selected subset within the eligible token words is utilized to determine a descriptive identifier associated with the specific process grouping.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: A source computational instance may be configured to operate a software application and store a first set of content related to the software application. A target computational instance may be configured to operate the software application and store a second set of content related to the software application. The software application operated by the target computational instance may apply transformation rules to received content before storing the received content in the second set of content. The source computational instance may be further configured to receive selected content chosen from the first set of content and an indication of the target computational instance, and transmit the selected content to the target computational instance. The target computational instance may be further configured to receive the selected content, apply the transformation rules to the selected content, and store the selected content within the second set of content.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: An embodiment may involve receiving an account identifier, wherein the account identifier is associated with a service account; transmitting a first API query to a remote computing system based on the account identifier; receiving first information associated with a first resource based on the first API query, wherein the first resource corresponds to a cloud orchestrator associated with a first service provided by the remote computing system; transmitting a first set of queries to the remote computing system based on the first information; receiving second information about a cluster of resources, associated with the first resource, based on the first set of queries, wherein a set of services related to the first service are deployed in one or more resources of the cluster of resources; generating a relationship map between the first resource and the cluster of resources based on the second information; and outputting the relationship map.

Abstract: A computing system includes a database and a discovery application that initiates discovery of software applications within a managed network by probing the computing devices for applications in stalled thereon. The discovery application executes discovery patterns in an attempt to classify a discovered application and determines that the discovered application is unclassified after executing the discovery patterns. In response to determining that the discovered application is unclassified, the discovery application (i) generates a configuration item representing the discovered application without classification and (ii) selects a characteristic file containing attributes of the discovered application. The discovery application provides the characteristic file to a machine learning (ML) classifier trained using a plurality of characteristic files.

Abstract: A computing system includes persistent storage configured to store representations of software applications that include textual data respectively indicative of attributes of the software applications, and a mapping application configured to perform operations. The operations include retrieving a representation corresponding to a software application and, based thereon, identifying character strings present within textual data associated therewith. The operations also include generating, for each character string, a corresponding weight based on a frequency of the character string within the particular textual data and a frequency of the character string within textual data associated with at least a subset of the software applications. The operations additionally include selecting, from the character strings and based on the corresponding weights, candidate tags for the particular software application.

Abstract: A computing system may include a database disposed within a remote network management platform that manages a managed network, and a software application associated with the platform and configured to: obtain, from an external computing system, information about a function-application arranged to execute source code segment(s) on demand; determine that the obtained information relates to (i) a plurality of authorization-keys each respectively arranged to authorize on-demand execution of one of the source code segments, (ii) a first key-value string pair that enables establishment of connectivity to a service of the external computing system or of another computing system, and/or (iii) a second key-value string pair that enables establishment of connectivity to a data source of the external computing system or of another computing system, and responsively determine association(s) between the source code segment(s), the function-application, the service, and/or the data source; and store the association(s) in t

Abstract: A discovery computing system may receive an account identifier (ID) and a set of credentials required to access a first service account. The discovery computing system may transmit a first API query to a remote computing system. The discovery computing system may receive an organization identifier (ID) of the organization from the remote computing system. The discovery computing system may further transmit a second API query to the remote computing system. The discovery computing system may be further configured to receive information about a set of projects, in the organization, from the remote computing system. The discovery computing system may further generate a set of service accounts and further determine the set of resources, in the remote computing system, associated with each of the generated set of service accounts. The discovery computing system may further store the determined set of resources, as configuration items in a persistent storage.

Abstract: A regular expression that is able to be used to identify an item as belonging to a specific group among a plurality of different groups is determined. The regular expression is tested against a sampling of items known to belong to the specific group to determine a true positive metric. The regular expression is tested against a sampling of items known to belong to other groups among the plurality of different groups outside the specific group to determine a false positive metric. An accuracy metric of the determined regular expression is calculated based at least in part on the true positive metric and the false positive metric. The accuracy metric is provided for use in evaluating the regular expression.

Abstract: Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Abstract: A system may include persistent storage configured to store: a shared classification model including a plurality of classifiers based on training data from a plurality of managed networks, and a representation of a plurality of software applications executable computing devices within a particular managed network. The system may also include a discovery application configured to perform operations including obtaining attributes of a software process. The operations may also include determining, by way of the shared classification model and based on the attributes, a suggested classifier of the plurality of classifiers and determining, by way of the suggested classifier and based on the attributes, a suggested classification for the software process.