Abstract: A method of evaluating change risk in an IT environment, including collecting environment state snapshots of configuration parameters in the IT environment, invoking a manifest of a change on the environment state snapshots to form simulated environment state snapshots, analyzing the simulated environment state snapshots relative to the environment state snapshots, deriving a risk score based on the analysis and selectively perform the change responsive to the risk score.

Abstract: A method of change reconciliation, including: detecting changes in configuration parameters collected from stations of a system and collecting or generating change request records for the detected changes, identifying unauthorized changes and authorized changes based on given rules, for a potentially authorized change that is not clearly authorized or unauthorized, identifying a context for the change request records, including: a) identifying authorized change implementers; b) identifying a scope of the content that is to be changed; c) identifying a time window when the change is allowed to be performed; identifying a context for the actual change, including: a) identifying a change implementer; b) identifying a scope of the content that was changed; c) identifying a time window when the change was performed; comparing the context of the change request with the context of the actual change; determining an authorization score responsive to said comparing; outputting the change authorization score.

Abstract: A method of incident root cause analysis in an information technology (IT) system, wherein upon occurrence of an incident collecting changes to configuration items and/or system parameters on computer stations during a predetermined time prior to the incident, calculating a change lifetime for each of the collected changes, comparing the change lifetime to the time of occurrence of the incident to determine if the lifetime of the change is still valid, marking a probability value of zero for occurrence of the incident as a result of the change for changes with an expired lifetime value at the time of the incident, otherwise estimating a risk profile and calculating from it a probability value for occurrence of the incident as a result of the change, sorting the changes according to the probability value, and selecting a predetermined number of changes having the highest probability values for root cause analysis.

Abstract: A method for analyzing and prioritizing configuration parameters in an information technology system, including collecting configuration parameters from computer stations connected in a network implementing the information technology system, storing the collected configuration parameters in a database, analyzing the configuration parameters by a set of anomaly routines, wherein each anomaly routine checks for a specific type of anomaly and provides a score representing a level of conformity of the value of the configuration parameters to the anomaly, aggregating the anomaly scores; and outputting a list of configuration parameters with an aggregated anomaly score.

Abstract: A method of determining component dependencies in an enterprise application architecture implemented over an enterprise network, including identifying structures of hosts connected to the network; wherein the structures includes applications executed by the host, obtaining configuration parameters from said hosts, determining dependencies between applications of hosts based on the configuration parameters, receiving a template for identifying dependencies between components in the enterprise network, identify candidate mappings of hosts based on the template, further identifying candidate mappings of host pairs based on the determined dependencies between hosts and the template, analyzing the candidate mappings to calculate a probability score for the candidate mappings, output the candidate mappings having the highest score.

Abstract: A method of clustering changes to configuration items in an information technology (IT) system, including collecting changed configuration items executed on computer stations connected in a network implementing the information technology system, storing the collected configuration items in a database, analyzing contextual information related to the configuration items to identify clusters having similar characteristics, clustering the configuration items based on the identified clusters having similar characteristics, and assigning a descriptor to each cluster to identify it as an IT action.

Abstract: A method of determining component dependencies in an enterprise application architecture implemented over an enterprise network, including identifying structures of hosts connected to the network; wherein the structures includes applications executed by the host, obtaining configuration parameters from said hosts, determining dependencies between applications of hosts based on the configuration parameters, receiving a template for identifying dependencies between components in the enterprise network, identify candidate mappings of hosts based on the template, further identifying candidate mappings of host pairs based on the determined dependencies between hosts and the template, analyzing the candidate mappings to calculate a probability score for the candidate mappings, output the candidate mappings having the highest score.

Abstract: A method for analyzing and prioritizing configuration parameters in an information technology system, including collecting configuration parameters from computer stations connected in a network implementing the information technology system, storing the collected configuration parameters in a database, analyzing the configuration parameters by a set of anomaly routines, wherein each anomaly routine checks for a specific type of anomaly and provides a score representing a level of conformity of the value of the configuration parameters to the anomaly, aggregating the anomaly scores; and outputting a list of configuration parameters with an aggregated anomaly score.

Abstract: A method of incident root cause analysis in an information technology (IT) system, wherein upon occurrence of an incident collecting changes to configuration items and/or system parameters on computer stations during a predetermined time prior to the incident, calculating a change lifetime for each of the collected changes, comparing the change lifetime to the time of occurrence of the incident to determine if the lifetime of the change is still valid, marking a probability value of zero for occurrence of the incident as a result of the change for changes with an expired lifetime value at the time of the incident, otherwise estimating a risk profile and calculating from it a probability value for occurrence of the incident as a result of the change, sorting the changes according to the probability value, and selecting a predetermined number of changes having the highest probability values for root cause analysis.

Abstract: A method of clustering changes to configuration items in an information technology (IT) system, including collecting changed configuration items executed on computer stations connected in a network implementing the information technology system, storing the collected configuration items in a database, analyzing contextual information related to the configuration items to identify clusters having similar characteristics, clustering the configuration items based on the identified clusters having similar characteristics, and assigning a descriptor to each cluster to identify it as an IT action.