Granted Patent B1

US 12,591,676 · App. 18/169,063 · Granted Mar 31, 2026

Inventors: Glenn Gallien (San Francisco, CA); Sourabh Satish (Fremont, CA)

Assignee: Cisco Technology, Inc.

G06F21/568G06F21/554G06F21/561H04L63/1416H04L63/20G06F16/29G06F16/9537

Abstract

Claims (55)

1 . A computer-implemented method comprising:

receiving input defining a first course of action, wherein the first course of action includes a first plurality of steps to respond to incidents occurring in information technology (IT) environments, wherein a first step of the first plurality of steps represents a call to a second course of action;

initiating execution of the first course of action;

identifying, during execution of the first course of action, the first step of the first plurality of steps representing the call to the second course of action;

initiating execution of the second course of action;

obtaining result data based on the execution of the second course of action;

identifying a first format of the result data;

determining that a second step of the first plurality of steps uses as input result data in a second format that is different from the first format at least by a level of accuracy;

translating the result data from the first format to the second format, wherein one of the first format or the second format corresponds to location information for an Internet Protocol address associated with an incident where the location information is in a form of a geographical code, and the other of the first format or the second format corresponds to geographical coordinates; and

executing, based on the second format of the result data, the second step of the first plurality of steps of the first course of action to respond to the incident occurring in an IT environment, wherein the second step comprises comparing the result data with one or more criteria.

2 . The method of claim 1 , further comprising:

receiving, via a graphical user interface provided by an incident service, input defining the first course of action, wherein the input defines a graphical diagram indicative of sequencing for the first plurality of steps; and

storing data defining the first course of action in a course of action database managed by the incident service.

3 . The method of claim 1 , wherein the result data comprises addressing data for the incident occurring in the IT environment.

4 . The method of claim 1 , wherein the second step comprises a step to compare the result data with a threshold.

5 . The method of claim 1 , wherein the first course of action includes a plurality of operations each corresponding to a different data format, and wherein translating the result data from the first format to the second format includes executing an operation of the plurality of operations associated with the first format.

6 . The method of claim 1 , further comprising:

receiving, via a graphical user interface, input defining the second course of action; and

storing data defining the second course of action in a course of action database.

7 . The method of claim 1 , further comprising:

in response to encountering the first step of the first plurality of steps during execution of the first course of action, pausing execution of the first course of action; and

in response to obtaining the result data, resuming execution of the first course of action.

8 . The method of claim 1 , wherein the first course of action involves modifying configuration of a component in an IT environment.

9 . A computing device comprising:

a processor; and

a non-transitory, computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

receiving input defining a first course of action, wherein the first course of action includes a first plurality of steps to respond to incidents occurring in information technology (IT) environments, wherein a first step of the first plurality of steps represents a call to a second course of action;

initiating execution of the first course of action;

identifying, during execution of the first course of action, the first step of the first plurality of steps representing the call to the second course of action;

initiating execution of the second course of action;

obtaining result data based on the execution of the second course of action;

identifying a first format of the result data;

determining that a second step of the first plurality of steps uses as input result data in a second format that is different from the first format at least by a level of accuracy;

translating the result data from the first format to the second format, wherein one of the first format or the second format corresponds to location information for an Internet Protocol address associated with an incident where the location information is in a form of a geographical code, and the other of the first format or the second format corresponds to geographical coordinates; and

executing, based on the second format of the result data, the second step of the first plurality of steps of the first course of action to respond to the incident occurring in an IT environment, wherein the second step comprises comparing the result data with one or more criteria.

10 . The computing device of claim 9 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

receiving, via a graphical user interface provided by an incident service, input defining the first course of action, wherein the input defines a graphical diagram indicative of sequencing for the first plurality of steps; and

storing data defining the first course of action in a course of action database managed by the incident service.

11 . The computing device of claim 9 , wherein the result data comprises addressing data for the incident occurring in the IT environment.

12 . The computing device of claim 9 , wherein the result data comprises geographic location information.

13 . A non-transitory, computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause a system to perform operations including:

receiving input defining a first course of action, wherein the first course of action includes a first plurality of steps to respond to incidents occurring in information technology (IT) environments, wherein a first step of the first plurality of steps represents a call to a second course of action;

initiating execution of the first course of action;

identifying, during execution of the first course of action, the first step of the first plurality of steps representing the call to the second course of action;

initiating execution of the second course of action;

obtaining result data based on the execution of the second course of action;

identifying a first format of the result data;

determining that a second step of the first plurality of steps uses as input result data in a second format that is different from the first format at least by a level of accuracy;

translating the result data from the first format to the second format, wherein one of the first format or the second format corresponds to location information for an Internet Protocol address associated with an incident where the location information is in a form of a geographical code, and the other of the first format or the second format corresponds to geographical coordinates; and

executing, based on the second format of the result data, a second step of the first plurality of steps of the first course of action to respond to the incident occurring in an IT environment, wherein the second step comprises comparing the result data with one or more criteria.

14 . The non-transitory, computer-readable medium of claim 13 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

receiving, via a graphical user interface provided by an incident service, input defining the first course of action, wherein the input defines a graphical diagram indicative of sequencing for the first plurality of steps; and

storing data defining the first course of action in a course of action database managed by the incident service.

15 . The non-transitory, computer-readable medium of claim 13 , wherein the result data comprises addressing data for the incident occurring in the IT environment.

16 . The non-transitory, computer-readable medium of claim 13 , wherein the result data comprises geographic location information.

Assignments (2)

Continuity (1)

References Cited (26)