Abstract: Methods and systems for discovering software applications are disclosed. A plurality of reports corresponding to a plurality of candidate applications is obtained from a plurality of entities, wherein each report comprises information corresponding to a plurality of software processes associated with one of the plurality of candidate applications and running on one of the plurality of entities. Correlations among the plurality of reports corresponding to the plurality of candidate applications from the plurality of entities are identified. A software application classifier for automatically identifying one or more software processes associated with an application that is used across multiple entities is generated based at least in part on the identified correlations. The software application classifier is provided to at least one of the plurality of entities.

Abstract: A method including parsing, via a Large Language Model (LLM), a configuration file comprising one or more attributes associated with one or more components of a network, wherein parsing the configuration file comprises generating a probe based on the one or more attributes. The method also includes executing the probe for discovery of one or more attributes associated with the one or more components of the network and updating a resource management database based on the one or more attributes.

Abstract: An implementation may involve: obtaining a representation of a network event relating to a network, wherein the network enables operation of a plurality of services each involving one or more computing devices or software applications; obtaining information associated with the network event, wherein the information identifies one of the computing devices or the software applications; based on the information, identifying a subset of services of the plurality of services based on determining that each of the subset of services satisfies an impact criterion with respect to the network event, wherein the subset of services are associated with candidate service maps that were generated by a machine learning process; and providing an indication that the subset of services are related to the network event.

Abstract: Data communication between a plurality of computer processes are tracked. The data communication between the plurality of computer processes are analyzed to classify relationships between the plurality of computer processes. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered. A visual map of the discovered service is generated.

Abstract: A method and system for detecting malicious activities in an IT infrastructure, determining its impact to the IT infrastructure, and determining the associated remedial actions are disclosed. Data communication between a plurality of computer processes is tracked. At least one process of the plurality of computer processes is identified as an anomalous process with respect to at least some of the plurality of computer processes. A first computer process of the plurality of computer processes that is affected by the anomalous computer process is identified based on at least a portion of the tracking. An indication of the identified first computer process that is affected by the anomalous computer process is provided.

Abstract: Data communication between a plurality of computer processes are tracked. Relationships between the plurality of computer processes are classified including by analyzing the data communication between the plurality of computer processes using a machine learning model. Based at least in part on the classified relationships between the plurality of computer processes, an existence of a service provided by a functional group of computer processes included in the plurality of computer processes are automatically discovered.

Abstract: One or more parameters of one or more processes identified as belonging to a specific process grouping among a plurality of process groupings are obtained. Eligible token words in the one or more parameters are identified. The eligible token words are processed to select a subset within the eligible token words that are likely descriptive of the specific process grouping. The selected subset within the eligible token words is utilized to determine a descriptive identifier associated with the specific process grouping.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: A mock server implementation for discovery applications is provided. A computing system includes a mock server, which receives a client request from a mock client on a discovery server. The client request corresponds to a user query associated with a discovery of resources on a remote computing system. The mock server determines a first response from a mock response dataset. The first response to the client request is determined based on the received client request. The mock response dataset includes a set of responses associated with a sequence of operations executed in the past for the discovery of resources on the remote computing system. The mock server transmits the determined first response to the mock client on the discovery server. The mock client receives the transmitted first response and sends the received first response to a discovery application interface on a user device.

Abstract: A computing system includes a database and a discovery application. The discovery application obtains credentials for accessing a server hosting a software bus application which connects a plurality of applications within a managed network. The discovery application selects, based on a pattern corresponding to the software bus application, one or more files to access, transmits, to the server, instructions to access the one or more files, and receives therefrom data identifying a plurality of attributes of the software bus application. Based on this data, the discovery application transmits, to the server, instructions to identify communicative connections established between the plurality of software applications by way of the software bus application and receives therefrom data identifying the communicative connections.

Abstract: A computing system includes a database and a discovery application that initiates discovery of software applications within a managed network by probing the computing devices for applications in stalled thereon. The discovery application executes discovery patterns in an attempt to classify a discovered application and determines that the discovered application is unclassified after executing the discovery patterns. In response to determining that the discovered application is unclassified, the discovery application (i) generates a configuration item representing the discovered application without classification and (ii) selects a characteristic file containing attributes of the discovered application. The discovery application provides the characteristic file to a machine learning (ML) classifier trained using a plurality of characteristic files.

Abstract: A computing system includes persistent storage configured to store representations of software applications that include textual data respectively indicative of attributes of the software applications, and a mapping application configured to perform operations. The operations include retrieving a representation corresponding to a software application and, based thereon, identifying character strings present within textual data associated therewith. The operations also include generating, for each character string, a corresponding weight based on a frequency of the character string within the particular textual data and a frequency of the character string within textual data associated with at least a subset of the software applications. The operations additionally include selecting, from the character strings and based on the corresponding weights, candidate tags for the particular software application.

Abstract: A computing system may include a database disposed within a remote network management platform that manages a managed network, and a software application associated with the platform and configured to: obtain, from an external computing system, information about a function-application arranged to execute source code segment(s) on demand; determine that the obtained information relates to (i) a plurality of authorization-keys each respectively arranged to authorize on-demand execution of one of the source code segments, (ii) a first key-value string pair that enables establishment of connectivity to a service of the external computing system or of another computing system, and/or (iii) a second key-value string pair that enables establishment of connectivity to a data source of the external computing system or of another computing system, and responsively determine association(s) between the source code segment(s), the function-application, the service, and/or the data source; and store the association(s) in t

Abstract: A discovery computing system may receive an account identifier (ID) and a set of credentials required to access a first service account. The discovery computing system may transmit a first API query to a remote computing system. The discovery computing system may receive an organization identifier (ID) of the organization from the remote computing system. The discovery computing system may further transmit a second API query to the remote computing system. The discovery computing system may be further configured to receive information about a set of projects, in the organization, from the remote computing system. The discovery computing system may further generate a set of service accounts and further determine the set of resources, in the remote computing system, associated with each of the generated set of service accounts. The discovery computing system may further store the determined set of resources, as configuration items in a persistent storage.

Abstract: A regular expression that is able to be used to identify an item as belonging to a specific group among a plurality of different groups is determined. The regular expression is tested against a sampling of items known to belong to the specific group to determine a true positive metric. The regular expression is tested against a sampling of items known to belong to other groups among the plurality of different groups outside the specific group to determine a false positive metric. An accuracy metric of the determined regular expression is calculated based at least in part on the true positive metric and the false positive metric. The accuracy metric is provided for use in evaluating the regular expression.

Abstract: Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Abstract: A system may include persistent storage configured to store: a shared classification model including a plurality of classifiers based on training data from a plurality of managed networks, and a representation of a plurality of software applications executable computing devices within a particular managed network. The system may also include a discovery application configured to perform operations including obtaining attributes of a software process. The operations may also include determining, by way of the shared classification model and based on the attributes, a suggested classifier of the plurality of classifiers and determining, by way of the suggested classifier and based on the attributes, a suggested classification for the software process.

Abstract: A computing system includes persistent storage configured to store representations of software applications installed on computing devices, and a software application configured to perform operations, including retrieving, from the persistent storage, a first plurality of representations of a first plurality of software applications installed on a particular computing device and a second plurality of representations of a second plurality of software applications installed on a reference computing device. The operations also include determining a device fingerprint of the particular computing device based on the first plurality of representations and a reference device fingerprint of the reference computing device based on the second plurality of representations, and comparing the device fingerprint to the reference device fingerprint.

Abstract: The present disclosure relates generally to a system and method for synchronizing updates. A first cloud-based system may be embodied in a multi-instance or multi-tenant framework, and may provide for certain computing systems and configuration items. The first cloud-based system may include a probe system configured to retrieve a list of events from a second cloud computing system, wherein the list of events is representative of updates to resources provided by the second cloud computing system. The first cloud-based system may additionally include a sensor system configured to process the list of events to retrieve a payload for each event in the list of events. An update system may then update an updatable system included in the first cloud computing system based on the payload.