Abstract: Data communication between a plurality of computer processes are tracked. The data communication between the plurality of computer processes are analyzed to classify relationships between the plurality of computer processes. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered. A visual map of the discovered service is generated.

Abstract: A method and system for detecting malicious activities in an IT infrastructure, determining its impact to the IT infrastructure, and determining the associated remedial actions are disclosed. Data communication between a plurality of computer processes is tracked. At least one process of the plurality of computer processes is identified as an anomalous process with respect to at least some of the plurality of computer processes. A first computer process of the plurality of computer processes that is affected by the anomalous computer process is identified based on at least a portion of the tracking. An indication of the identified first computer process that is affected by the anomalous computer process is provided.

Abstract: A method including parsing, via a Large Language Model (LLM), a configuration file comprising one or more attributes associated with one or more components of a network, wherein parsing the configuration file comprises generating a probe based on the one or more attributes. The method also includes executing the probe for discovery of one or more attributes associated with the one or more components of the network and updating a resource management database based on the one or more attributes.

Abstract: An implementation may involve: obtaining a representation of a network event relating to a network, wherein the network enables operation of a plurality of services each involving one or more computing devices or software applications; obtaining information associated with the network event, wherein the information identifies one of the computing devices or the software applications; based on the information, identifying a subset of services of the plurality of services based on determining that each of the subset of services satisfies an impact criterion with respect to the network event, wherein the subset of services are associated with candidate service maps that were generated by a machine learning process; and providing an indication that the subset of services are related to the network event.

Abstract: Embodiments of the subject technology relate to systems, methods, and computer-readable media for automatically generating a playbook. Specifically, incidents having resolutions can be clustered together through an embedding model based on a similarity criterion. A summary of each of the incidents can be generated through an LLM. A playbook for resolving an incident can be inferred through the LLM based on the summaries of the incidents.

Abstract: An example implementation may involve: obtaining a representation of an alert; identifying a host within a network that is associated with the alert; selecting, from a plurality of service maps defining services that are operable within the network, a service map including the host; identifying process-to-process connections between the host and each of one or more other hosts; and generating, based on the process-to-process connections, a group alert indicator characterizing respective relationships between the alert and alerts associated with the one or more other hosts.

Abstract: An implementation may involve: obtaining a representation of a network event relating to a network, wherein the network enables operation of a plurality of services each involving one or more computing devices or software applications; obtaining information associated with the network event, wherein the information identifies one of the computing devices or the software applications; based on the information, identifying a subset of services of the plurality of services based on determining that each of the subset of services satisfies an impact criterion with respect to the network event, wherein the subset of services are associated with candidate service maps that were generated by a machine learning process; and providing an indication that the subset of services are related to the network event.

Abstract: A method includes obtaining a query and determining a task to be performed based on the query by a task dispatcher LLM. The method includes routing, by the task dispatcher LLM, a prompt to one of a plurality of LLM-based agents based on the task to be performed. The method includes obtaining information uniquely associated with the one of the plurality of LLM-based agents and conditioning the one of the plurality of LLM-based agents on the obtained information. The method includes generating a response to the prompt by the one of the plurality of LLM-based agents conditioned on the obtained information. The method includes generating an output based on the response to the prompt by the task dispatcher LLM.

Abstract: Methods and systems for discovering software applications are disclosed. A plurality of reports corresponding to a plurality of candidate applications is obtained from a plurality of entities, wherein each report comprises information corresponding to a plurality of software processes associated with one of the plurality of candidate applications and running on one of the plurality of entities. Correlations among the plurality of reports corresponding to the plurality of candidate applications from the plurality of entities are identified. A software application classifier for automatically identifying one or more software processes associated with an application that is used across multiple entities is generated based at least in part on the identified correlations. The software application classifier is provided to at least one of the plurality of entities.

Abstract: A method including parsing, via a Large Language Model (LLM), a configuration file comprising one or more attributes associated with one or more components of a network, wherein parsing the configuration file comprises generating a probe based on the one or more attributes. The method also includes executing the probe for discovery of one or more attributes associated with the one or more components of the network and updating a resource management database based on the one or more attributes.

Abstract: An implementation may involve: obtaining a representation of a network event relating to a network, wherein the network enables operation of a plurality of services each involving one or more computing devices or software applications; obtaining information associated with the network event, wherein the information identifies one of the computing devices or the software applications; based on the information, identifying a subset of services of the plurality of services based on determining that each of the subset of services satisfies an impact criterion with respect to the network event, wherein the subset of services are associated with candidate service maps that were generated by a machine learning process; and providing an indication that the subset of services are related to the network event.

Abstract: Data communication between a plurality of computer processes are tracked. The data communication between the plurality of computer processes are analyzed to classify relationships between the plurality of computer processes. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered. A visual map of the discovered service is generated.

Abstract: A method and system for detecting malicious activities in an IT infrastructure, determining its impact to the IT infrastructure, and determining the associated remedial actions are disclosed. Data communication between a plurality of computer processes is tracked. At least one process of the plurality of computer processes is identified as an anomalous process with respect to at least some of the plurality of computer processes. A first computer process of the plurality of computer processes that is affected by the anomalous computer process is identified based on at least a portion of the tracking. An indication of the identified first computer process that is affected by the anomalous computer process is provided.

Abstract: Data communication between a plurality of computer processes are tracked. Relationships between the plurality of computer processes are classified including by analyzing the data communication between the plurality of computer processes using a machine learning model. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered.

Abstract: One or more parameters of one or more processes identified as belonging to a specific process grouping among a plurality of process groupings are obtained. Eligible token words in the one or more parameters are identified. The eligible token words are processed to select a subset within the eligible token words that are likely descriptive of the specific process grouping. The selected subset within the eligible token words is utilized to determine a descriptive identifier associated with the specific process grouping.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: A mock server implementation for discovery applications is provided. A computing system includes a mock server, which receives a client request from a mock client on a discovery server. The client request corresponds to a user query associated with a discovery of resources on a remote computing system. The mock server determines a first response from a mock response dataset. The first response to the client request is determined based on the received client request. The mock response dataset includes a set of responses associated with a sequence of operations executed in the past for the discovery of resources on the remote computing system. The mock server transmits the determined first response to the mock client on the discovery server. The mock client receives the transmitted first response and sends the received first response to a discovery application interface on a user device.

Abstract: A computing system includes a database and a discovery application. The discovery application obtains credentials for accessing a server hosting a software bus application which connects a plurality of applications within a managed network. The discovery application selects, based on a pattern corresponding to the software bus application, one or more files to access, transmits, to the server, instructions to access the one or more files, and receives therefrom data identifying a plurality of attributes of the software bus application. Based on this data, the discovery application transmits, to the server, instructions to identify communicative connections established between the plurality of software applications by way of the software bus application and receives therefrom data identifying the communicative connections.

Abstract: A computing system includes a database and a discovery application that initiates discovery of software applications within a managed network by probing the computing devices for applications in stalled thereon. The discovery application executes discovery patterns in an attempt to classify a discovered application and determines that the discovered application is unclassified after executing the discovery patterns. In response to determining that the discovered application is unclassified, the discovery application (i) generates a configuration item representing the discovered application without classification and (ii) selects a characteristic file containing attributes of the discovered application. The discovery application provides the characteristic file to a machine learning (ML) classifier trained using a plurality of characteristic files.