Embodiments described herein are directed to dynamic generation of performance state trees. In embodiments, a performance metric for determining a performance state for components is received. A query is dynamically generated based on the performance metric. A performance state is determined for components based on an associated value according to an identified performance metric. Architectural information including relationships between components is retrieved. Thereafter, a visual output, including a tree, is dynamically generated based on the architectural information. The individual nodes in the tree are displayed with respective graphical indications of the performance states of the respective represented components.
G06F 3/0482 - Interaction with lists of selectable items, e.g. menus
G06F 3/0488 - Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser using a touch-screen or digitiser, e.g. input of commands through traced gestures
G06F 9/455 - EmulationInterpretationSoftware simulation, e.g. virtualisation or emulation of application or operating system execution engines
G06F 11/32 - Monitoring with visual indication of the functioning of the machine
G06F 11/34 - Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation
G06F 16/2458 - Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
G06F 16/26 - Visual data miningBrowsing structured data
A method of monitoring hierarchical asset groups includes the operations of: receiving a plurality of asset group configuration parameters comprising one or more association specifications, each association specification defining an association between an asset and a corresponding asset group of a plurality of asset groups of an asset hierarchy; receiving definitions of one or more asset group metrics, wherein each asset group metric of the one or more asset group metrics is derived from a search of machine data associated with a corresponding asset group; associating, with each asset group of the plurality of asset groups, a corresponding asset group metric of the one or more asset group metrics; generating one or more alert definitions associated with an asset group of the plurality of asset groups; monitoring, using the one or more asset group metrics, the asset hierarchy; and generating an alert based on the one or more alert definitions.
A system that enables a user to configure alert actions based on search results generated by a query is disclosed. During operation, the system presents an alert user interface (UI) to a user, wherein the alert UI enables the user to configure one or more alert actions to be performed based on the search results. Next, the system receives alert configuration information from the user through the alert UI, wherein the alert configuration information includes tokens representing parameters associated with the query and the search results. Then, while generating an alert associated with the search results, the system performs a token substitution operation that substitutes tokens in the alert configuration information with corresponding parameters from the search results to generate a payload that is communicated to alert-generating functionality. This token substitution allows the parameters to be used by the alert-generating functionality while performing the one or more alert actions.
Techniques are described for providing an integrated development environment (IDE) extension that assists developers with many aspects developing apps for an information technology (IT) and security operations application. For example, the IDE extension includes functionality to assist with packaging and deploying apps to a remote IT and security operations application, viewing information about apps installed by a remote IT and security operations application, and testing app action implementations within their IDE. The IDE extension significantly increases developers' ability to create functional and stable IT and security operations application apps for interfacing with a wide variety of security technologies, thereby improving the security and stability of IT environments in which the apps are used.
G06F 21/54 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure by adding security routines or objects to programs
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
In embodiments, a computer-implemented method may entail receiving a search request. A first data store and a second data store, that contains data archived from the first data store, may be identified. Data from the first data store may remain available in the first data store for a limited period of time once archived to the second data store. The first data store storing data in a first format and the second data store storing data in a second format, the first format and the second format being different from one another. Determining that a subset of data that has been archived into the second data store and is to be searched as part of the search request is still available from the first data store, and executing the search request on the subset of data utilizing the first data store. Additional embodiments are described and/or claimed.
A host computing device can include a plurality of isolated execution environments and a communication buffer. Each of the isolated execution environments can include an application interface, a plurality of collector modules, a coordinator module, and a scheduler module. The application interface can determine configurations for a plurality of connectors configured to collect data from respective data sources. The plurality of collector modules can include collector modules that correspond to one or more connectors and collect data from data sources of one or more tenants. The coordinator module can monitor execution of the plurality of collector modules and the scheduler module can assign collector modules of a connector between the plurality of isolated execution environments. The communication buffer can include configuration data, connector-isolated execution environment assignments, and a status of collector modules.
In some embodiments, a method may include display of a data summary view of a set of events that correspond to query results of a query. Each event of the set of events may include data items of a plurality of event attributes. In embodiments, the data summary view can include various summary reports. Each summary report can include summary entries and a summary graph that each present a summary of data items of a selected event attribute, of the plurality of event attributes. At least one summary report can include summary entries that are selectable by a user. The method may further include filtering the set of event, in response to, and based on, selection of one or more of the selectable summary entries by the user and updating of at least the first and second summary graphs to correspond to the filtered set of events.
G06F 3/0482 - Interaction with lists of selectable items, e.g. menus
G06F 3/0484 - Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
G06F 3/04842 - Selection of displayed objects or displayed text elements
G06F 16/00 - Information retrievalDatabase structures thereforFile system structures therefor
A method of monitoring hierarchical asset groups includes the operations of: receiving a plurality of asset group configuration parameters comprising one or more association specifications, each association specification defining an association between an asset and a corresponding asset group of a plurality of asset groups of an asset hierarchy; receiving definitions of one or more asset group metrics, wherein each asset group metric of the one or more asset group metrics is derived from a search of machine data associated with a corresponding asset group; associating, with each asset group of the plurality of asset groups, a corresponding asset group metric of the one or more asset group metrics; generating one or more alert definitions associated with an asset group of the plurality of asset groups; monitoring, using the one or more asset group metrics, the asset hierarchy; and generating an alert based on the one or more alert definitions.
A data intake and query system can process a query to identify subquery tokens corresponding to subqueries to be executed by external data systems. The data intake and query system can process the subquery tokens to generate modified subqueries to be executed by the external data systems. The modified subqueries can cause the external data system to return metadata associated with the events processed by the external data systems during executing of the modified subqueries.
Disclosed herein are systems and methods for improving the auto-generation of pipelined search query statements by a large language model (LLM). In some examples, such a method includes operations of receiving a user-provided prompt, wherein the user-provided prompt is provided in natural language, identifying an objective of the user-provided prompt, and based on the objective, providing the user-provided prompt to a first operational pipeline of a plurality of operational pipelines, wherein each operational pipeline is associated with a unique prompt template. Additionally, the method may include generating, by the first pipeline, an auto-generated prompt based on a first unique prompt template of the first pipeline, providing the auto-generated prompt to a large language model (LLM), and receiving a response to the auto-generated prompt from the LLM. A graphical user interface (GUI) may then be generated that displays the response to the auto-generated prompt.
Systems and methods are described for processing ingested data, detecting anomalies in the ingested data, and providing explanations of a possible cause of the detected anomalies as the data is being ingested. For example, a token or field in the ingested data may have an anomalous value. Tokens or fields from another portion of the ingested data can be extracted and analyzed to determine whether there is any correlation between the values of the extracted tokens or fields and the anomalous token or field having an anomalous value. If a correlation is detected, this information can be surfaced to a user.
Implementations of this disclosure provide a machine learning model training system that receives user input being a natural language description of a search query, and packages and transmits the natural language description as a prompt to a plurality of large learning models (LLMs). The model training system also receives response from the plurality of LLMs being translations of the natural language descriptions to an executable search query and displays the translations to a user via a graphical user interface. The model training system receives user feedback via the graphical user interface that corresponds to indications as to whether each translation is correct, syntactically and/or semantically, and, in some examples, an indication of which response was preferred. The model training system also generates training data from the user input, translations generated by the plurality of LLMs, and user feedback, and subsequently, initiates training of a LLM using the training data.
A query coordinator can receive a query and identify a first portion of the query to be processed by a first data processing system and a second portion of the query to be processed by a second data processing system. The query coordinator can obtain a modified query based on identifying the first portion and the second portion of the query. The query coordinator can define a query processing scheme according to the modified query and provide the query processing scheme to the second data processing system. Based on providing the query processing scheme, the query coordinator can obtain an output of the second data processing system. The query coordinator can identify a second query based on the output and provide the second query to a component of the first data processing system.
A data intake and query system can manage the search of data stored at an external location relative to the data intake and query system using one or more indexers. The data intake and query system can receive data stored at the external location. The data intake and query system can process the data and generate an index using the one or more indexers. The data intake and query system can discard the data and store the index and a location identifier of the external location in one or more buckets. In response to a query, the data intake and query system can identify that at least a subset of the data is responsive to the query using the index and can obtain the at least the subset of the data from the external location using the location identifier.
Computerized methodologies are disclosed that are directed to detecting anomalies within a time-series data set. An aspect of the anomaly detection process includes determining one or more seasonality patterns that correspond to a specific time-series data set by evaluating a set of candidate seasonality patterns (e.g., hourly, daily, weekly, day-start off-sets, etc.). The evaluation of a candidate seasonality pattern may include dividing the time-series data set into a collection of subsequences based on the particular candidate seasonality pattern. Further, the collection of subsequences may be divided into clusters and a silhouette score may be computed to measure the clustering quality of the candidate seasonality pattern. In some instances, the candidate seasonality pattern having the highest silhouette score is selected and utilized in anomaly detection process. In other instances, a plurality of seasonality patterns may be combined forming a time policy, where the time policy is utilized in anomaly detection process.
Queries may be resolved against large quantities of collected data (such as traces) by dividing collected data into multiple time intervals and incrementally assigning multiple workers the query and the collected data over the multiple time intervals. For each time interval, these workers may conditionally update one or more summary data structures within the worker based on the query and the portion of collected data assigned to the worker. The summary data structures for each time interval may then be incrementally returned and merged with results from earlier time intervals to create a final merged query result.
Techniques are described for providing a threat analysis platform capable of automating actions performed to analyze security-related threats affecting IT environments. Users or applications can submit objects (e.g., URLs, files, etc.) for analysis by the threat analysis platform. Once submitted, the threat analysis platform routes the objects to dedicated engines that can perform static and dynamic analysis processes to determine a likelihood that an object is associated with malicious activity such as phishing attacks, malware, or other types of security threats. The automated actions performed by the threat analysis platform can include, for example, navigating to submitted URLs and recording activity related to accessing the corresponding resource, analyzing files and documents by extracting text and metadata, extracting and emulating execution of embedded macro source code, performing optical character recognition (OCR) and other types of image analysis, submitting objects to third-party security services for analysis, among many other possible actions.
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
Described are systems, methods, and techniques for collecting, analyzing, processing, and storing time series data and for evaluating and determining whether and how to include late or delayed data points when publishing or storing the time series data. Maximum delay values can identify a duration for waiting for late or delayed data, such as prior to publication. In some examples, maximum delay values can be dynamically adjustable based on a statistical evaluation process. For late or delayed data points that are received after the maximum delay elapses, some data points can be included in the stored time series data, such as if they are received in the same order that they are generated.
Described are systems, methods, and techniques for collecting, analyzing, processing, and storing time series data and for evaluating and dynamically estimating a resolution of one or more streams of data points and updating an output resolution. Responsive to receiving a stream of data points, a data resolution can be derived and an output resolution can be set to a first value. When a change to the data resolution is detected, the output resolution can be changed, modifying a frequency at which output data points are generated and/or transmitted. In some instances, a detector can be implemented to trigger an alert responsive to ingested data points corresponding with triggering parameters. An output resolution for the detector can be dynamically modified based on dynamically detecting a change to the data resolution of the stream of data.
A blockchain consortium network can be implemented in which nodes of one or more blockchains generate data for pipeline-based processing by a consortium pipeline system. The generated data can include private blockchain data, public blockchain data, and machine data, such as logs or operational metrics from the nodes. The data is collected from different network levels and can be transformed via pipeline processes of the consortium pipeline system to securely share data in the blockchain consortium network.
G06F 21/52 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure
H04L 9/00 - Arrangements for secret or secure communicationsNetwork security protocols
21.
DISTRIBUTED TASK ASSIGNMENT, DISTRIBUTED ALERTS AND SUPRESSION MANAGEMENT, AND ARTIFACT LIFE TRACKING STORAGE IN A CLUSTER COMPUTING SYSTEM
A processing node selects a first task from a task list and sends, to a task assignment repository, a first write operation with a first task identifier of the first task to assign the first task to the processing node. The processing node detects failure of the first write operation based on the first task already being assigned and selects a second task from the task list. The processing node sends, to the task assignment repository, a second write operation with a second task identifier of the second task to assign the second task to the processing node. The processing node detects success of the second write operation and executes the second task.
Techniques are described for providing on-premises action execution agents used to execute orchestration, automation, and response (OAR) actions in users' IT environments. An on-premises action execution agent can be used to execute actions involving computing resources located in users' on-premises IT environments, where such resources may be located behind a firewall and thus not directly accessible to an IT and security operations application running in a cloud-based environment or elsewhere. An intermediary secure tunnel service is used to establish secure connections between an IT and security operations application and on-premises action execution agents, thereby enabling the encrypted transfer of credentials, API tokens, and other sensitive information used by an on-premises action execution agent to execute actions. The executed actions can include on-demand actions initiated by a user and automated actions included, e.g., as part of a playbook that is executed responsive to the identification of certain types of incidents.
Extended reality (XR) software application programs establish remote collaboration sessions in which a host device and one or more remote devices can interact. When initiating a remote collaboration session, an XR application in a host device determines a collaboration area. The collaboration area corresponds to a portion of a real-world environment that is shared by the host device with the one or more remote devices. In some embodiments, the collaboration area can be determined automatically and/or based on user input. The XR application causes sensors associated with the host device to scan the collaboration area. Then, the XR application transmits, to the one or more remote devices, a three-dimensional representation of the collaboration area for rendering in one or more remote XR environments.
Various implementations set forth a computer-implemented method for scanning a three-dimensional (3D) environment. The method includes generating, in a first time interval, a first extended reality (XR) stream based on a first set of meshes representing a 3D environment, transmitting, to a remote device, the first XR stream for rendering a 3D representation of a first portion of the 3D environment in a remote XR environment, determining that the 3D environment has changed based on a second set of meshes representing the 3D environment and generated subsequent to the first time interval, generating a second XR stream based on the second set of meshes, and transmitting, to the remote device, the second XR stream for rendering a 3D representation of at least a portion of the changed 3D environment in the remote XR environment.
Various implementations set forth a computer-implemented method for scanning a three-dimensional (3D) environment. The method includes generating, in a first time interval, a first extended reality (XR) stream based on a first set of meshes representing a 3D environment, transmitting, to a remote device, the first XR stream for rendering a 3D representation of a first portion of the 3D environment in a remote XR environment, determining that the 3D environment has changed based on a second set of meshes representing the 3D environment and generated subsequent to the first time interval, generating a second XR stream based on the second set of meshes, and transmitting, to the remote device, the second XR stream for rendering a 3D representation of at least a portion of the changed 3D environment in the remote XR environment.
Techniques are described for providing an extension framework for an IT and security operations application. The described extension framework allows various types of users to extend the user interfaces, data content, and functionality of an IT and security operations application to enhance and enrich users' workflow and investigative experiences. Example types of extensions enabled by the extension framework include modifying or supplementing GUI elements and other components, where users can implement these extensions at pre-defined extension points of the IT and security operations application. The extension framework further includes a data integration system that provides users with mechanisms to integrate data from external applications, services, or other data sources into their plugins.
H04L 41/22 - Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks comprising specially adapted graphical user interfaces [GUI]
Systems and methods are described for customizable data streams in a streaming data processing system. Routing criteria for the customizable data streams are defined by a user, an automated process, or any other process. The routing criteria can be defined using graphical controls. The streaming data processing system uses the routing criteria to determine data that should be used to populate a particular data stream. Further, processing pipelines are customized such that a particular processing pipeline can obtain data from a particular user defined data stream and write data to a particular user defined data stream. Data is routed through the user defined data streams and customized processing pipelines based on a data route. A data route for a set of data may include multiple user defined data streams and multiple processing pipelines. The data route can include a loop of processing pipelines and data streams.
Disclosed are embodiments of a system for receiving, from a product management system, a model trained to select one state from a set of predefined states based on a state of an installation of a software program on a computing device. Each of the predefined states are associated with a configuration of the software program and each configuration of the software program are associated with operational parameter values of the software program. The system further determines a state of the installation of the software program, inputs the determined state into the model, obtains, from the model, and based on the determined state, the selection of the one state from the set of predefined states. Finally, the system adjusts a parameter of the software program according to the selected one predefined state.
A graphical user interface (GUI) for presentation of network security risk and threat information is disclosed. A listing is generated of incidents identified by use of event data obtained from a networked computing environment. A particular incident is determined to be associated with a risk object, wherein a risk object is a component of the networked computing environment. The listing is populated with a name associated with the risk object. Risk events associated with the incident are determined, wherein each risk event contributes to a risk score for the incident. The risk score indicates a potential security issue associated with the risk object. The listing is populated with the risk score and a summary of the events. An action is associated with the listing, for triggering display of additional information associated with the risk object. The listing can be displayed in a first display screen of the GUI.
A method of rendering a graphical visualization that provides end-to-end visibility into a user session comprises aggregating spans associated with the user session. The method also comprises rendering a graphical visualization representing events and aggregated metrics over the entirety of the user session. Additionally, the method comprises rendering a waterfall visualization that comprises spans associated with events in the user session, where the water visualization can be constrained to a select period within the user session. The method also comprises displaying the graphical visualization and the waterfall visualization in a graphical user interface.
Systems and methods are described herein for synthesizing traces from logs of a distributed computing system. A trace represents a single transaction, such as handling of a user request, on the distributed computing system. The transaction can include multiple underlying operations on the distributed computing system, which are represented as spans within the trace and may be hierarchically arranged within the trace. In instances where a distributed computing system does not provide for tracing natively, a trace can be synthesized from log entries of the distributed computing system. A streaming data processing system can ingest a data stream including log entries, and identify within the data stream those log entries relating to a given transaction. The streaming data processing system can further identify log entries that demark the beginnings and endings of operations for that transaction, and can utilize the identified log entries to build a trace for the transaction.
Systems and methods for rule-based data stream processing by data collection, indexing, and visualization systems. An example method includes: receiving, by the computer system, an input data stream comprising raw machine data; processing the raw machine data by a data processing pipeline that produces transformed machine data, wherein the data processing pipeline comprises an ordered plurality of pipeline stages, wherein a pipeline stage of the ordered plurality of pipeline stages applies a rule of a set of rules to an input of the pipeline stage, wherein the rule specifies an action to be performed on the input of the pipeline stage responsive to evaluating a conditional expression applied to the input of the pipeline stage, wherein the action generates an output of the pipeline stage, and wherein the rule is selected based on a source type associated with the input data stream; and supplying the transformed machine data to a data collection, indexing, and visualization system.
Various implementations of the present application set forth a method comprising generating a host extended reality (XR) environment representing a physical space that includes a real-world asset, generating, based on sensor data captured by a depth sensor on a mobile device, three-dimensional data representing the physical space, generating, based on sensor data captured by an image sensor on the mobile device, two-dimensional data representing the physical space, generating, based on the three-dimensional data and the two-dimensional data, an adaptable three-dimensional (3D) representation of the physical space, transforming the adaptable 3D representation into geometry data comprising a set of vertices, a set of faces comprising edges between pairs of vertices, and texture data, transmitting the geometry data to a set of one or more remote devices for at least a partial reconstruction of the adaptable 3D representation of the physical space in a set of one or more remote environments.
Various implementations of the present application set forth a method comprising generating, based on first sensor data captured by a depth sensor on a mobile device, three-dimensional data representing a physical space that includes a real-world asset, generating, based on second sensor data captured by an image sensor on the mobile device, two-dimensional data representing the physical space, combining, based on a correlation the three-dimensional data and the two-dimensional data, the two-dimensional data and the three-dimensional data into an extended reality (XR) stream, where the XR stream includes a digital representation of the real-world asset, and transmitting, to a remote device, the XR stream for rendering at least a portion of the digital representation of the real-world asset in a remote XR environment.
Various implementations or examples set forth a method for scanning a three-dimensional (3D) environment. The method includes generating a 3D representation of the 3D environment that includes one or more 3D meshes. The method also includes determining at least a portion of the 3D environment that falls within a current frame captured by the image sensor. The method further includes generating one or more additional 3D meshes representing the at least a portion of the 3D environment and combining the one or more additional 3D meshes with the one or more 3D meshes into an update to the 3D representation of the 3D environment.
Embodiments of the present invention are directed to facilitating performing online data decomposition. In accordance with aspects of the present disclosure, an incoming data point of a time series data set is obtained. Thereafter, an iterative process of estimating trend and seasonality is performed to decompose the incoming data point to a set of data components based on a particular set of previous data points of the time series data set and corresponding data components. Generally, the set of data components for the incoming data point include a trend component, a seasonality component, and a residual component. The set of data components is provided for analysis of the incoming data point, such as, for example, to identify data anomalies.
Systems and methods are described for training an artificial intelligence model to extract one or more data fields from a log. For example, the artificial intelligence model may be a neural network. The neural network may be trained using training data obtained by iterating through a plurality of logs using active learning, and selecting a subset of the logs in the plurality to be labeled by a user. For example, the selected subset of logs may be logs that are not similar to other logs already labeled by a user. The user may be prompted to label the selected subset of logs to identify one or more data fields to extract. Once the selected subset of logs are labeled, these labeled logs can be used as the training data to train the neural network.
A method of computing a workload performed by a group of related spans within a microservices-based application executing in a distributed computing environment comprises aggregating a plurality of ingested spans associated with one or more applications executing in the distributed computing environment into a plurality of traces. The method also comprises retrieving a set of traces from the plurality of traces in response to a query and tracking an execution time of each respective group of related spans in the set of traces, wherein the tracking an execution time is performed for a plurality of groups. Further, the method comprises tracking a cumulative execution time for the plurality of groups and computing a workload ratio associated with each respective group of related spans using an execution time associated with a respective group and the cumulative execution time for the plurality of groups.
Systems and methods are disclosed for implementing dual textual/graphical programming interfaces for programming streaming data processing pipelines. A user interface is provided that enables a user to author a processing pipeline as a query in a query language, and to request conversion of that query language into a graph data structure representation of the pipeline, which can be visualized in the interface. The interface further enables modification of the graph via interaction with the visualization. On request, the modified graph can be converted back into the query language, with the querying being modified to reflect the modifications to the graph. In some embodiments, the graph data structure representation and/or the query language representation of the pipeline can be converted into a third representation, such as an Abstract Syntax Tree, that is deployed to an intake system to implement the pipeline.
G06F 3/0481 - Interaction techniques based on graphical user interfaces [GUI] based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
40.
ANALYZING TAGS ASSOCIATED WITH HIGH-LATENCY AND ERROR SPANS FOR INSTRUMENTED SOFTWARE
A computer-implemented method for analyzing spans and traces associated with a microservices-based application executing in a distributed computing environment comprises aggregating a plurality of ingested spans associated with one or more applications executing in the distributed computing environment into a plurality of traces, wherein each of the plurality of ingested spans is associated with a plurality of tags. The method further comprises comparing durations of a set of related traces of the plurality of traces to determine patterns for the plurality of tags and generating a histogram that represents a distribution of the durations of the set of related traces. The method also comprises providing alerts for one or more tags from the plurality of tags associated with traces having a duration above a threshold based on the distribution of the durations.
In various embodiments, a computer-implemented method comprises acquiring, using an edge sensor device, first sensor data associated with a physical device operating within a physical environment, where the edge sensor device includes a first set of sensors of a first sensor type for obtaining the first sensor data, and the edge sensor device is located proximal to the physical device, inputting, by the edge sensor device, the first sensor data into an onboard message bus to publish the first sensor data, wherein a processing device of the edge sensor device maintains the onboard message bus, and upon receipt of the first sensor data, transmitting, by the onboard message bus, the first sensor data onto a network, where the first sensor data is addressed to a first set of one or more subscribers of the onboard message bus, and the one or more subscribers includes a remote server computing system.
A method of analyzing a performance of a microservices-based application comprises generating a plurality of traces from a plurality of spans associated with the microservices-based application. The method also comprises generating a plurality of data sets each associated with a respective analysis mode of a plurality of analysis modes using the plurality of traces, wherein each analysis mode extracts a different level of detail for analyzing the performance of the services in the application from the plurality of spans. Further, the method comprises selecting, based on a first user query, a first analysis mode from the plurality of analysis modes for generating a response to the first user query. The method also comprises accessing a data set of the plurality of data sets that is associated with the first analysis mode and generating the response to the first user query using the data set associated with the first analysis mode.
Systems and methods are described for processing ingested data using an online machine learning algorithm as the data is being ingested. For example, the online machine learning algorithm can be an adaptive thresholding algorithm used to identify outliers in a moving window of data. As another example, the online machine learning algorithm can be a sequential outlier detector that detects anomalous sequences of logs or events. As another example, the online machine learning algorithm can be a sentiment analyzer that determines whether text has a positive, negative, or neutral sentiment. As another example, the online machine learning algorithm can be a drift detector that detects whether ingested data marks the start of a change in the distribution of a time-series.
Techniques are described for providing an IT and security operations mobile application for managing IT and security operations instances of an IT and security operations application via a mobile device. The IT and security operations mobile application can be linked to the IT and security operations application to enable the IT and security operations application to send messages (e.g., notifications, alerts, action requests, etc.) related the occurrences of incidents/events in an IT environment, such as security-related incident, that can impact the operation of the IT environment. The IT and security operations mobile application enables a user to respond to the messages by initiating actions that are sent to the IT and security operations application for executing within the IT environment.
G06F 21/55 - Detecting local intrusion or implementing counter-measures
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/62 - Protecting access to data via a platform, e.g. using keys or access control rules
H04L 29/06 - Communication control; Communication processing characterised by a protocol
45.
SEARCH TIME ESTIMATE IN DATA INTAKE AND QUERY SYSTEM
Systems and methods are described for determining a query execution time in a data intake and query system. The system parses a query to identify different portions of the query that are executed by different components of the data intake and query system. The system determines a query execution time for the different portions of the query based on the corresponding components. Based on the query execution time of the different portions for the query, the system determines a query execution time for the query.
Computing devices, computer-readable storage media, and computer-implemented methods are disclosed for prediction of capacity. In a central tier, central-tier benchmark values are generated from benchmark testing performed on different test configurations in a reference execution environment. In a deployment tier, deployment-tier benchmark values are generated from benchmark testing performed on a baseline deployed configuration in many execution environments. A sizing model is learned from the central-tier benchmark values to predict execution platform requirements given a set of workload input parameters. A performance model is learned from the deployment-tier and the central-tier benchmark values to predict a performance delta value reflecting relative performance between a particular execution environment and the reference execution environment. The performance delta value is used to adjust predicted execution platform requirements to tailor the prediction to a particular execution environment. The predicted execution platform requirements can be deployed and tested to validate or tune the performance model.
Embodiments of the present disclosure provide for trace and span sampling and analysis for instrumented software. Each span may be annotated with one or more tags that provide context about an executed task, such as a user instrumenting the software, a document involved in a request, an infrastructure element used in servicing a request, etc. A sampler may perform tail-based sampling of traces comprising spans. The sampler may select a portion of the traces having selected features and send them to an analyzer. The analyzer may receive the selected traces and determine whether the selected traces are indicative of configuration problems for the instrumented software. An alert may be generated based on identified configuration problems.
Systems and methods are disclosed for receiving, at a first data intake and query system, a query that includes an indication to process data managed by another data intake and query system. The first data intake and query system identifies a second data intake and query system that manages the data to be processed and generates a subquery for execution by the second data intake and query system, generates instructions for one or more worker nodes to receive and process results of the subquery from the second data intake and query system, and instructs the worker nodes to provide results of the processing to the first data intake and query system.
Systems and methods for testing a subject system with a software testing process are described. The system receives boolean states responsive to repeatedly applying a first test case to a subject system. Each boolean state signifies an outcome of an application of the first test case to a version of a first software feature over a span of time. The system identifies test case outcomes for the first test case that are adjacent in time and different and generates an intermittency value for the first test case. The system determines that the intermittency value for the first test case exceeds an intermittency threshold and alerts an engineering resource. Finally, the system repeats the above steps until the intermittency value for the first test case does not exceed the intermittency threshold.
42 - Scientific, technological and industrial services, research and design
Goods & Services
Software as a service (SAAS) featuring software for use in the analysis of customer data; infrastructure as a service (IAAS) featuring software for managing, operating, monitoring, troubleshooting and configuring private cloud computer networks, managing network storage, and for deploying and installing software applications over networks; technical support services, namely, remote infrastructure management services for monitoring, administration and management of private cloud computing IT and application systems; technical support services, namely, troubleshooting in the nature of diagnosing computer software problems; updating and maintaining cloud-based computer software through patches and online updates; computer services, namely, cloud hosting provider services; computer services, namely, remote and on-site management of cloud computing systems and applications for others; computer services, namely, remote and on-site management of the information technology (IT) cloud computing systems of others
09 - Scientific and electric apparatus and instruments
Goods & Services
Downloadable cloud-computing software for use in managing websites, databases, third party subscription services and resources, Software As A Service (SaaS) subscriptions, electronic data storage, electronic data backup
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
45 - Legal and security services; personal services for individuals.
Goods & Services
Computer software for automating and orchestrating cyber
security operations; computer software platforms for cyber
security, and automating and orchestrating cyber security
operations. Computer consultation in the field of computer security;
computer services, namely, integration of computer software
into multiple systems and networks; maintenance of computer
software relating to computer security and prevention of
computer risks; software as a service (SAAS) services,
namely, hosting software for use by others for use in cyber
security. Computerized security services, namely, electronically
monitoring, detecting and reporting on suspicious and
abnormal patterns of point of sale activity indicating
theft, fraud, or other criminal activity; consulting
services in the field of homeland security; consulting
services in the field of national security; monitoring of
computer systems for security purposes; security
consultancy.
09 - Scientific and electric apparatus and instruments
42 - Scientific, technological and industrial services, research and design
45 - Legal and security services; personal services for individuals.
Goods & Services
(1) Computer software for automating and orchestrating cyber security operations; computer software platforms for cyber security, and automating and orchestrating cyber security operations. (1) Computer consultation in the field of computer security; computer services, namely, integration of computer software into multiple systems and networks; maintenance of computer software relating to computer security and prevention of computer risks; software as a service (SAAS) services, namely, hosting software for use by others for use in cyber security; computer security consultancy; internet security consultancy; computerized security services, namely, electronically monitoring, detecting and reporting on suspicious and abnormal patterns of point of sale activity indicating theft, fraud, or other criminal activity.
(2) Consulting services in the field of homeland security; consulting services in the field of national security; monitoring of computer systems for security purposes.
54.
TOPOLOGY MAP DISPLAYS OF CLOUD COMPUTING RESOURCES
Techniques and mechanisms are disclosed that enable collection of various types of data from cloud computing services and the generation of various dashboards and visualizations to view information about collections of cloud computing resources. A user can configure collection of data from one or more cloud computing services and view visualizations using an application platform referred to herein as a cloud computing management application. A cloud computing management application further may be configured to generate and cause display of interactive topology map representations of cloud computing resources based on the collected data, where an interactive topology map enables users to view an intuitive visualization of a collection of computing resources, efficiently cause performance of actions with respect to various resources displayed in the topology map, and analyze the collection of resources in ways that are not possible using conventional cloud computing service management consoles.
An analysis system receives data streams generated by instances of instrumented software executing on external systems. The analysis system evaluates an expression using data values of the data streams over a plurality of time intervals. For example, the analysis system may aggregate data values of data streams for each time interval. The analysis system determines whether or not a data stream is considered for a time interval based on when the data value arrives during the time interval. The analysis system determines a maximum expected delay value for each data stream being processed. The analysis system evaluates the expression using data values that arrive before their maximum expected delay values. The analysis system also determines a failure threshold value for a data stream. If a data value of a data stream fails to arrive before the failure threshold value, the analysis system marks the data stream as dead.
56.
DATA STREAM PROCESSING LANGUAGE FOR ANALYZING INSTRUMENTED SOFTWARE
An instrumentation analysis system processes data streams by executing instructions specified using a data stream language program. The data stream language allows users to specify a search condition using a find block for identifying the set of data streams processed by the data stream language program. The set of identified data streams may change dynamically. The data stream language allows users to group data streams into sets of data streams based on distinct values of one or more metadata attributes associated with the input data streams. The data stream language allows users to specify a threshold block for determining whether data values of input data streams are outside boundaries specified using low/high thresholds. The elements of the set of data streams input to the threshold block can dynamically change. The low/high threshold values can be specified as data streams and can dynamically change.
An instrumentation analysis system processes data streams by executing instructions specified using a data stream language program. The data stream language allows users to specify a search condition using a find block for identifying the set of data streams processed by the data stream language program. The set of identified data streams may change dynamically. The data stream language allows users to group data streams into sets of data streams based on distinct values of one or more metadata attributes associated with the input data streams. The data stream language allows users to specify a threshold block for determining whether data values of input data streams are outside boundaries specified using low/high thresholds. The elements of the set of data streams input to the threshold block can dynamically change. The low/high threshold values can be specified as data streams and can dynamically change.
The disclosed embodiments provide a system that processes data received from a remote system. During operation, the system sends, from a computer system to a remote system, a request for a local time at the remote system and records a time of transmission of the request. Next, the system obtains, from the remote system, a response to the request, wherein the response includes the local time of the remote system. The system then computes a difference between the time of transmission and the local time of the remote system to determine a time offset that accounts for a time difference between the computer system and the remote system. Finally, the system uses the time offset to standardize timestamps in time-series data received from the remote system, wherein standardizing the timestamps associated with the time-series data comprises adjusting the timestamps to conform to a time standard.
A data analysis system processes data generated by instrumented software. The data analysis system receives data streams generated by instances of instrumented software executing on systems. The data analysis system also receives metadata describing data streams. The data analysis system receives an expression based on the metadata. The data analysis system receives data of data streams for each time interval and computes the result of the expression based on the received data values. The data analysis system repeats these steps for each time interval. The data analysis system may quantize data values of data streams for each time interval by generating an aggregate value for the time interval based on data received for each data stream for that time interval. The data analysis system evaluates the expression using the quantized data for the time interval.
A data analysis system processes data generated by instrumented software. The data analysis system receives data streams generated by instances of instrumented software executing on systems. The data analysis system also receives metadata describing data streams. The data analysis system receives an expression based on the metadata. The data analysis system receives data of data streams for each time interval and computes the result of the expression based on the received data values. The data analysis system repeats these steps for each time interval. The data analysis system may quantize data values of data streams for each time interval by generating an aggregate value for the time interval based on data received for each data stream for that time interval. The data analysis system evaluates the expression using the quantized data for the time interval.
A data analysis system processes data generated by instrumented software. The data analysis system receives data streams generated by instances of instrumented software executing on systems. The data analysis system also receives metadata describing data streams. The data analysis system receives an expression based on the metadata. The data analysis system receives data of data streams for each time interval and computes the result of the expression based on the received data values. The data analysis system repeats these steps for each time interval. The data analysis system may quantize data values of data streams for each time interval by generating an aggregate value for the time interval based on data received for each data stream for that time interval. The data analysis system evaluates the expression using the quantized data for the time interval.
Systems and methods for managing datasets produced by alert-triggering search queries in data aggregation and analysis systems. An example method may comprise: executing, by one or more processing devices, a search query on a portion of searchable data associated with a time window to produce a dataset comprising one or more results; responsive to determining that at least a portion of the dataset satisfies a triggering condition defining an alert associated with the search query, generating an instance of the alert; associating, by a memory data structure, the instance of the alert with an identifier of the search query and a time parameter specifying the time window; receiving, from a client computing device, a request for the portion of the dataset; and responsive to determining that the portion of the dataset is not stored in the memory in a manner associating it with the instance of the alert, reproducing the portion of the dataset by re- executing the search query in view of the time parameter.
A processing device receives input representing a selection of one or more areas of an image and creates a blurred area for the one or more selected areas. The blurred area corresponds to a portion of the image that contains the one or more selected areas. The portion of the image has a size that is greater than an aggregate size of the one or more selected areas. The processing device replaces the one or more selected areas with the corresponding portion of the blurred area.
Systems and methods for presenting and sorting summaries of alerts triggered by search queries in data aggregation and analysis systems. An example method may comprise: causing; by one or more processing devices, one or more alert summaries to be displayed, each alert summary corresponding to an alert and representing one or more instances of the alert, the alert defined by a search query and a triggering condition; wherein an instance of the alert corresponds to a particular dataset that (i) is generated by executing the search query over time- series data falling within a particular time range in a set of time ranges over which the search query has been instructed to search, and (ii) satisfies the triggering condition for the alert; wherein an alert summary includes an indication of at least one of: a total count of alert instances generated by the alert, or a count of alert instances generated by the alert that have not been viewed by a user.
An anomaly detection system is able to detect spatial and temporal environment anomalies and spatial and temporal behavior anomalies, and monitor servers for anomalous characteristics of the environment and behavior. If metrics and/or characteristics associated with a given server are beyond a certain threshold, an alert is generated. Among other options, the alert can take the form of a heat map or a cluster cohesiveness report.
09 - Scientific and electric apparatus and instruments
16 - Paper, cardboard and goods made from these materials
35 - Advertising and business services
38 - Telecommunications services
41 - Education, entertainment, sporting and cultural services
42 - Scientific, technological and industrial services, research and design
Goods & Services
(1) Computer server operating software; computer search engine software; and instructional manuals sold as a unit therewith; printed matter, namely, manuals, white papers, magazines, newsletters and user guides in the field of information technology (1) Business consulting services in the field of information technology; providing multiple user access to global computer networks for the transfer and dissemination of a wide range of information; providing on-line electronic bulletin boards for transmission of messages among computer users in the fields of computer operation and networking and information technology; educational services, namely, providing training, tutoring, classes and seminars in the field of computers, computer software and computer networks and the development and operation of computing networks and distribution of course materials in connection therewith; providing on-line non-downloadable software for indexing and making searchable data from any application, server or network device; consulting services in the field of information technology; technical consulting services in the field evaluation and implementation of information technology and services; technical support services, namely, remote and on-site infrastructure management services for monitoring, administration and management of public and private computer application systems
09 - Scientific and electric apparatus and instruments
35 - Advertising and business services
38 - Telecommunications services
42 - Scientific, technological and industrial services, research and design
Goods & Services
(1) Computer client and server software for indexing, searching, and monitoring client's data from any computer software application, mobile software application, server, and network device; computer client and server software for providing operational intelligence, business analytics, troubleshooting, and monitoring based on client data; and computer client and server software for producing reports, dashboards, and alerts from client data; computer search engine software and instructional manuals sold as a unit therewith. (1) Providing multiple user access to global computer networks for the transfer and dissemination of a wide range of information and data; providing on-line electronic bulletin boards for transmission of messages among computer users in the fields of computer operation, networking, and information technology.
(2) Software as a service (SaaS) services delivered on-demand and via cloud-based and cloud-hosted offerings, featuring software for indexing, searching, and monitoring client's data from any application, server, and network device; providing operational intelligence, business analytics, troubleshooting, and monitoring based on client data; and producing reports, dashboards, and alerts from client data; computer software consulting; and technical support services, namely, remote and on-site infrastructure management services for monitoring, administration, and management of public and private computer application systems.
Embodiments are directed towards a system and method for a cloud-based front end that may abstract and enable access to the underlying cloud-hosted elements and objects that may be part of a multi-tenant application, such as a search application. Search objects may be employed to access indexed objects. An amount of indexed data accessible to a user may be based on an index storage limit selected by the user, such that data that exceeds the index storage limit may continue to be indexed. Also, one or more projects can be elastically scaled for a user to provide resources that may meet the specific needs of each project.
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
Embodiments are directed towards a system and method for a cloud-based front end that may abstract and enable access to the underlying cloud-hosted elements and objects that may be part of a multi-tenant application, such as a search application. Search objects may be employed to access indexed objects. An amount of indexed data accessible to a user may be based on an index storage limit selected by the user, such that data that exceeds the index storage limit may continue to be indexed. Also, one or more projects can be elastically scaled for a user to provide resources that may meet the specific needs of each project.
G06F 17/30 - Information retrieval; Database structures therefor
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
70.
SYSTEM AND METHOD FOR FAST FILE TRACKING AND CHANGE MONITORING
Embodiments are directed towards a dynamic change evaluation mechanism, whereby items having a detected possible change are scheduled for re-evaluation for possible changes at a higher frequency than items detected to not have previously changed, while those items detected as not to have changed are dynamically scheduled for re-evaluation based on an evaluation backlog that may be in turn based, in part, on a time from when an item is assigned an expiration time to when the item is evaluated. In one embodiment, a possibly changed item may be assigned a new expiration time independent of the evaluation backlog. In another embodiment, if no change is detected, then the item may be assigned a new expiration time as a function of a previous expiration time and on the evaluation backlog.
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.
A method, system, and processor-readable storage medium are directed towards generating a report derived from data, such as event data, stored on a plurality of distributed nodes. In one embodiment the analysis is generated using a "divide and conquer" algorithm, such that each distributed node analyzes locally stored event data while an aggregating node combines these analysis results to generate the report. In one embodiment, each distributed node also transmits a list of event data references associated with the analysis result to the aggregating node. The aggregating node may then generate a global ordered list of data references based on the list of event data references received from each distributed node. Subsequently, in response to a user selection of a range of global event data, the report may dynamically retrieve event data from one or more distributed nodes for display according to the global order.
G06F 17/30 - Information retrieval; Database structures therefor
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
73.
DISTRIBUTED LICENSE MANAGEMENT FOR A DATA LIMITED APPLICATION
The invention is directed towards enabling data volume and data type based licensing of software in a distributed system of a plurality of remote and/or local nodes. The invention enables measuring and optionally restricting the use of software based on one or more provided licenses that restrict the amount and type of data that may be processed by the software. New and older licenses may be added together for a single, bulk entitlement for a given volume of data processing for one or all types of data. Different users in the same enterprise may combine license entitlements too. Also, a new license can be acquired repeatedly, without requiring the issuance of combined licenses by the issuing authority and/or the revocation of prior licenses.
Embodiments are directed towards employing compressed journaling for event tracking files for metadata recovery and replication. Event data and related metadata are received from one or more client devices. When a feature within the received metadata is detected that is previously unwritten to a journal, then the previously unwritten feature is written to the journal. Further, any feature is detected for the received event data that is determined to be different from a feature associated with an immediately preceding event data that is written in the journal, then the detected different feature is identified in the journal. In one embodiment, the identification employs writing to the journal an effective feature record that may employ indices identifying the different feature. The received event data is also written to the journal and may further employ string arguments to minimize recording of redundant information into the journal.
G06F 17/30 - Information retrieval; Database structures therefor
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
75.
APPROXIMATE ORDER STATISTICS OF REAL NUMBERS IN GENERIC DATA
A method, system, and processor-readable storage medium are directed towards calculating approximate order statistics on a collection of real numbers. In one embodiment, the collection of real numbers is processed to create a digest comprising hierarchy of buckets. Each bucket is assigned a real number N having P digits of precision and ordinality O. The hierarchy is defined by grouping buckets into levels, where each level contains all buckets of a given ordinality. Each individual bucket in the hierarchy defines a range of numbers - all numbers that, after being truncated to that bucket's P digits of precision, are equal to that bucket's N. Each bucket additionally maintains a count of how many numbers have fallen within that bucket's range. Approximate order statistics may then be calculated by traversing the hierarchy and performing an operation on some or all of the ranges and counts associated with each bucket.
G06F 7/00 - Methods or arrangements for processing data by operating upon the order or content of the data handled
G06F 9/06 - Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
A system arranged to search machine data to generate reports in real time, A search query is provided that includes a plurality of search commands. The search query is parsed to form a main search query and a remote search query. Machine data is collected from remote data sources and evaluated against one of the main and remote search queries to generate a set of search results. The main search query is then evaluated against at least a partial set of the search result to generate at least one report regarding the collected machine data. Initially a search window is pre-populated with historical machine data related to the search query. Over time the historical machine data is replaced with the collected machine data.
09 - Scientific and electric apparatus and instruments
16 - Paper, cardboard and goods made from these materials
35 - Advertising and business services
38 - Telecommunications services
41 - Education, entertainment, sporting and cultural services
42 - Scientific, technological and industrial services, research and design
Goods & Services
(1) Computer hardware; Computer server software for providing search, troubleshooting, operational intelligence and business analytics using clients' data; computer search engine software; and instructional manuals sold as a unit therewith.
(2) Printed matter, namely, manuals, white papers, books, magazines, newsletters and user guides on the subject of information technology. (1) Business consulting services in the field of cloud computing.
(2) Providing multiple user access to global computer networks for the transfer and dissemination of a wide range of information, providing on-line electronic bulletin boards for transmission of messages among computer users in the fields of computer operation and networking and information technology in the field of cloud computing.
(3) Educational services, namely, providing training, tutorials, classes and seminars in the field of computers, computer software and computer networks and the development and operation of cloud computing networks.
(4) Cloud computing featuring software for indexing and making searchable data from any application, server or network device; Computer services, namely, remote and on-site management of cloud computing systems and applications for others; Consulting services in the field of cloud computing; Technical consulting services in the fields of datacenter architecture, public and private cloud computing solutions, and evaluation and implementation of internet technology and services; Technical support services, namely, remote and on-site infrastructure management services for monitoring, administration and management of public and private cloud computing IT and application systems.
Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time scries data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.
