Granted Patent B1

US 11,714,683 · App. 17/163,320 · Granted Aug 1, 2023

Inventors: Jeffery Roberts (Orleans, CA); Matthew Hanson (San Jose, CA); Ryan Connor Means (San Jose, CA); Jeffrey Roecks (San Carlos, CA); Taotao Yu (Fremont, CA)

Assignee: Splunk Inc.

G06F9/5027G06F9/45558G06F2009/45562G06F2009/45587

Abstract

Claims (51)

1. A computer-implemented method, comprising:

initiating a first execution of a playbook, wherein the playbook includes a plurality of function blocks that collectively define a series of operations to be performed in response to identification of an incident in an information technology (IT) environment, wherein each function block of the plurality of function blocks includes computer program source code that is executed upon encountering the function block during execution of the playbook;

sending, to a first computing resource of a plurality of computing resources, a first request to execute a first function block of the plurality of function blocks, wherein the first computing resource includes an execution environment used to execute the first function block, and wherein the first computing resource returns a result of executing the first function block;

sending, to a second computing resource of a plurality of computing resources, a second request to execute a second function block of the plurality of function blocks, wherein the second computing resource executes the second function block concurrently with the first computing resource executing the first function block;

initiating a second execution of the playbook; and

sending, to a third computing resource of the plurality of computing resources, a third request to execute the first function block of the plurality of function blocks, wherein the third computing resource executes the first function block concurrently with the first computing resource executing the first function block or the second computing resource executing the second function block.

2. The computer-implemented method of claim 1 , wherein the playbook is a first playbook including a first plurality of function blocks, and wherein the method further comprises:

initiating execution of a second playbook including a second plurality of function blocks; and

sending, to a third computing resource of the plurality of computing resources, a request to execute a third function block from the second plurality of function blocks, wherein the third computing resource executes the third function block concurrently with the first computing resource executing the first function block or the second computing resource executing the second function block.

3. The computer-implemented method of claim 1 , wherein the playbook is a first playbook including a first plurality of function blocks, and wherein the method further comprises:

initiating execution of a second playbook including a second plurality of function blocks;

determining a version of a programming language used to implement a third function block from the second plurality of function blocks;

sending, to a third computing resource of the plurality of computing resources, a request to execute the third function block, wherein the third computing resource hosts an execution environment that supports the version of the programming language used to implement the third function block of the second plurality of function blocks, wherein the third computing resource executes the third function block concurrently with the first computing resource executing the first function block or the second computing resource executing the second function block.

4. The computer-implemented method of claim 1 , wherein the first function block is implemented by first program source code associated with a first version of a programming language, wherein the playbook includes a third function block implemented by second program source code associated with a second version of the programming language, and wherein the method further includes sending, to a third computing resource, a request to execute the third function block, wherein the third computing resource hosts an execution environment that supports the second version of the programming language.

5. The computer-implemented method of claim 1 , further comprising generating a run record associated with the first execution of the playbook, wherein the run record includes a run identifier that uniquely identifies the first execution of the playbook.

6. The computer-implemented method of claim 1 , wherein the playbook is a first playbook including a first plurality of function blocks, and wherein the method further comprises:

initiating execution of a second playbook including a second plurality of function blocks, wherein the second playbook is associated with a global variable; and

sending, to a third computing resource of the plurality of computing resources, requests to execute each function block of the second plurality of function blocks.

7. The computer-implemented method of claim 1 , further comprising receiving input specifying a scaling limit, wherein the scaling limit indicates a maximum number of the plurality of computing resources to be used to execute playbooks.

8. The computer-implemented method of claim 1 , wherein each computing resource of the plurality of computing resources is one of: a process, a server, a virtual machine (VM), or a container.

9. The computer-implemented method of claim 1 , further comprising:

determining that an amount of time elapsed during execution of the second function block by the second computing resource exceeds a time-to-live (TTL) value; and

sending, to the second computing resource, a request to re-execute the second function block.

10. The computer-implemented method of claim 1 , further comprising:

receiving input specifying a time-to-live (TTL) value, wherein the TTL value indicates a maximum amount of time for computing resources to execute function blocks;

determining that an amount of time elapsed during execution of the second function block by the second computing resource exceeds the TTL value; and

sending, to the second computing resource, a request to re-execute the second function block.

11. The computer-implemented method of claim 1 , further comprising:

determining that an amount of time elapsed during execution of the second function block by the second computing resource exceeds a time-to-live (TTL) value;

determining, based on historical execution information associated with the playbook, to retry execution of the second function block; and

sending, to the second computing resource, a request to re-execute the second function block.

12. The computer-implemented method of claim 1 , further comprising storing information indicating a status of each computing resource of the plurality of computing resource, wherein the status indicates at least one of: an indication that a worker is currently executing a function block, an indication that a worker is idle, or an indication that the status of the worker is unknown.

13. The computer-implemented method of claim 1 , wherein execution of the playbook is managed by a playbook execution engine of an information technology (IT) and security operations application.

14. The computer-implemented method of claim 1 , wherein execution of the playbook is managed by a playbook execution engine of an information technology (IT) and security operations application, and wherein the IT and security operations application and plurality of computing resources are executed using resources of a cloud provider network.

15. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

initiating a first execution of a playbook, wherein the playbook includes a plurality of function blocks that collectively define a series of operations to be performed in response to identification of an incident in an information technology (IT) environment, wherein each function block of the plurality of function blocks includes computer program source code that is executed upon encountering the function block during execution of the playbook;

sending, to a first computing resource of a plurality of computing resources, a first request to execute a first function block of the plurality of function blocks, wherein the first computing resource includes an execution environment used to execute the first function block, and wherein the first computing resource returns a result of executing the first function block;

sending, to a second computing resource of a plurality of computing resources, a second request to execute a second function block of the plurality of function blocks, wherein the second computing resource executes the second function block concurrently with the first computing resource executing the first function block;

initiating a second execution of the playbook; and

sending, to a third computing resource of the plurality of computing resources, a third request to execute the first function block of the plurality of function blocks, wherein the third computing resource executes the first function block concurrently with the first computing resource executing the first function block or the second computing resource executing the second function block.

16. The computing device of claim 15 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

initiating execution of a second playbook including a second plurality of function blocks; and

sending, to a third computing resource of the plurality of computing resources, a request to execute a third function block from the second plurality of function blocks, wherein the third computing resource executes the third function block concurrently with the first computing resource executing the first function block or the second computing resource executing the second function block.

17. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

initiating a first execution of a playbook, wherein the playbook includes a plurality of function blocks that collectively define a series of operations to be performed in response to identification of an incident in an information technology (IT) environment, wherein each function block of the plurality of function blocks includes computer program source code that is executed upon encountering the function block during execution of the playbook;

sending, to a first computing resource of a plurality of computing resources, a first request to execute a first function block of the plurality of function blocks, wherein the first computing resource includes an execution environment used to execute the first function block, and wherein the first computing resource returns a result of executing the first function block; and

sending, to a second computing resource of a plurality of computing resources, a second request to execute a second function block of the plurality of function blocks, wherein the second computing resource executes the second function block concurrently with the first computing resource executing the first function block;

initiating a second execution of the playbook; and

sending, to a third computing resource of the plurality of computing resources, a third request to execute the first function block of the plurality of function blocks, wherein the third computing resource executes the first function block concurrently with the first computing resource executing the first function block or the second computing resource executing the second function block.

Assignments (3)

Cited By (11)

US 12,278,864 US 12,282,807 US 12,287,903 US 12,400,149 US 12,493,615 US 12,499,386 US 12,608,370 US 12,647,531 US 12,701,161 US 12,719,871 US 12,737,452