Simulated incident response using simulated result when actual result is unavailable

Patent metadata

Field	Value
Publication number	US-10985994-B1
Application number	US-201816051378-A
Country	US
Kind code	B1
Filing date	Jul 31, 2018
Priority date	Jul 31, 2018
Publication date	Apr 20, 2021
Grant date	Apr 20, 2021

Abstract

Described herein are improvements for generating courses of action for an information technology (IT) environment. In one example, a method includes identifying a first course of action for responding to an incident type in an information technology environment and generating a simulated incident associated with the incident type. The method further includes initiating performance of the first course of action based on the generation of the simulated incident. The method also includes, upon reaching a particular step of the first course of action that prevents the performance of the first course of action from proceeding, providing a first simulated result that allows the performance of the first course of action to proceed.

First claim

What is claimed is:

1. A computer-implemented method performed by an advisement system coupled to an information technology (IT) environment, the method comprising:
identifying first incident data indicating an occurrence of an incident affecting a computing asset in the IT environment, wherein the incident is associated with an incident type;
identifying, based on the first incident data, a course of action used to respond to incidents associated with the incident type;
generating second incident data representing a simulated incident, wherein generating the second incident data includes:
identifying the incident type associated with the incident,
generating incident characteristics associated with the incident type, wherein at least one of the incident characteristics is generated based on a characteristic of a computing asset in the IT environment involved in the incident, and
storing the incident characteristics as part of the second incident data;

executing the course of action using the second incident data as input;
identifying, during execution of the course of action, a step of the course of action that prevents execution of the course of action from proceeding to a next step;
generating a simulated result for the step of the course of action, wherein generating the simulated result includes generating a value based on a type of input used by the next step; and
using the simulated result for the step to allow execution of the course of action to proceed to the next step.

2. The method of claim 1 , further comprising:
identifying a plurality of paths that the course of action can optionally follow subsequent to the step preventing execution of the course of action from proceeding;
selecting a first path of the plurality of paths; and
generating the simulated result to cause the execution of the course of action to proceed down the first path.

3. The method of claim 1 , further comprising:
identifying a plurality of paths that the course of action can optionally follow subsequent to the step preventing execution of the course of action from proceeding;
selecting a first path of the plurality of paths;
generating the simulated result to cause the execution of the course of action to proceed down the first path;
selecting a second path of the plurality of paths; and
generating a second simulated result to cause the execution of the course of action to proceed down the second path.

4. The method of claim 1 , wherein the step is a first step, wherein the next step is a first next step, wherein the type of input is a first type of input, and wherein the method further comprises:
identifying, during execution of the course of action, a second step of the course of action that prevents execution of the course of action from proceeding to a second next step;
generating a second simulated result for the second step of the course of action, wherein generating the second simulated result includes generating a value based on a second type of input used by the second next step; and
using the second simulated result for the second step to allow execution of the course of action to proceed to the second next step.

5. The method of claim 1 , wherein identifying the step of the course of action that prevents execution of the course of action from proceeding to the next step includes determining that the step involves a service that is currently unavailable.

6. The method of claim 1 , wherein the second incident data representing the simulated incident includes user-defined characteristics.

7. The method of claim 1 , further comprising:
causing display of the course of action using a visual programming language.

8. The method of claim 1 , further comprising:
causing display of a progress indication for execution of the course of action in association with a visual programming language representation of the course of action.

9. The method of claim 1 , further comprising:
upon reaching the step, causing display of an indication that performance of the course of action cannot proceed from the step, wherein the indication is displayed nearby the step as represented by a visual programming language.

10. The method of claim 1 , further comprising:
causing display of a request element for the simulated result, wherein the request element is displayed nearby the step as represented by a visual programming language.

11. The method of claim 1 , wherein the incident characteristics include at least one of: network addresses involved in the incident, access privileges used in the incident, protocols used in the incident, or types of computing assets involved in the incident.

12. The method of claim 1 , wherein the second incident data is generated by copying incident data from a previously identified incident.

13. The method of claim 1 , further comprising determining that the next step accepts a value within a range of values, and wherein generating the simulated result for the step of the course of action includes generating a value within a range of values.

14. The method of claim 1 , further comprising:
identifying a plurality of paths that the course of action can optionally follow subsequent to the step preventing execution of the course of action from proceeding; and
executing two or more paths of the plurality of paths in parallel.

15. The method of claim 1 , further comprising:
receiving input requesting to modify a step of the course of action; and
modifying the step of the course of action.

16. One or more non-transitory computer readable storage media having program instructions stored thereon, the program instructions, when read and executed by a processing system, direct the processing system to:
identify first incident data indicating an occurrence of an incident affecting a computing asset in an IT environment, wherein the incident is associated with an incident type;
identify, based on the first incident data, a course of action used to respond to incidents associated with the incident type;
generate second incident data representing a simulated incident, wherein generating the second incident data includes:
identifying the incident type associated with the incident,
generating incident characteristics associated with the incident type, wherein at least one of the incident characteristics is generated based on a characteristic of a computing asset in the IT environment involved in the incident, and
storing the incident characteristics as part of the second incident data;

execute the course of action using the second incident data as input;
identify, during execution of the course of action, a step of the course of action that prevents execution of the course of action from proceeding to a next step;
generate a simulated result for the step of the course of action, wherein generating the simulated result includes generated a value based on a type of input used by the next step; and
use the simulated result for the step to allow execution of the course of action to proceed to the next step.

17. The one or more computer readable storage media of claim 16 , wherein the program instructions further direct the processing system to:
identify a plurality of paths that the course of action can optionally follow subsequent to the step preventing execution of the course of action from proceeding;
select a first path of the plurality of paths; and
generate the simulated result to cause the execution of the course of action to proceed down the first path.

18. The one or more computer readable storage media of

Assignees

• Splunk Inc

Inventors

• Mahadik Atif
• Means Ryan Connor
• Salinas Govind
• Satish Sourabh

Classifications

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L41/0677

  Localisation of faults · CPC title

• H04L41/0654

  using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) · CPC title

• H04L41/0645

  by additionally acting on or stimulating the network after receiving notifications · CPC title