US 2015O172400A1 (19) United States (12) Patent Application Publication (10) Pub. No.: US 2015/0172400 A1 Sarfati et al. (43) Pub. Date: Jun. 18, 2015 (54) MANAGEMENT OF (60) Provisional application No. 61/939,123, filed on Feb. INFORMATION-TECHNOLOGY SERVICES 12, 2014. (71) Applicants: Daniel Sarfati, Raanana (IL); Tanya Publication Classification Epstein, Barkan (IL); Bradley Joseph Hlista, Volente, TX (US); Robert Jon (51) Int. Cl. Harrington, Golden, CO (US); Samir H04L 29/08 (2006.01) Varma, Cos Cob, CT (US) (52) U.S. Cl. CPC ................ H04L 67/22 (2013.01); H04L 67/26 (72) Inventors: Daniel Sarfati, Raanana (IL); Tanya (2013.01) Epstein, Barkan (IL); Bradley Joseph Hlista, Volente, TX (US); Robert Jon (57) ABSTRACT Harrington, Golden, CO (US); Samir A system includes an application programming interface Varma, Cos Cob, CT (US) (API), a collection module configured to receive a data subset of a data set, the data Subset characterizing usage, by users of (21) Appl. No.: 14/621,189 a set of client devices of a client entity, of a plurality of software applications hosted on a network, wherein the API is (22) Filed: Feb. 12, 2015 configured to enable the client entity to define the data subset and push the data Subset to the collection module, a data Related U.S. Application Data storing module configured to store the collected data, and a processing module configured to determine, based on the (63) Continuation of application No. 14/133.550, filed on stored data, at least one usage rating for each of the plurality Dec. 18, 2013. of software applications. Syster 8,883: iProcessing is: irgii evices.} .. Patent Application Publication Jun. 18, 2015 Sheet 1 of 11 US 2015/0172400 A1 Patent Application Publication Jun. 18, 2015 Sheet 2 of 11 US 2015/0172400 A1 Patent Application Publication Jun. 18, 2015 Sheet 3 of 11 US 2015/0172400 A1 ? ?? ? ?? Patent Application Publication Jun. 18, 2015 Sheet 4 of 11 US 2015/0172400 A1 3 48 4 ;̤ Patent Application Publication Jun. 18, 2015 Sheet 5 of 11 US 2015/0172400 A1 *{3438384 43.48% Patent Application Publication Jun. 18, 2015 Sheet 6 of 11 US 2015/0172400 A1 { were SER g : Patent Application Publication Jun. 18, 2015 Sheet 7 of 11 US 2015/0172400 A1 w S. s r W Sea s & Patent Application Publication Jun. 18, 2015 Sheet 8 of 11 US 2015/0172400 A1 Patent Application Publication Jun. 18, 2015 Sheet 9 of 11 US 2015/0172400 A1 ? Patent Application Publication Jun. 18, 2015 Sheet 10 of 11 US 2015/0172400 A1 | 90009 Si Patent Application Publication Jun. 18, 2015 Sheet 11 of 11 US 2015/0172400 A1 sessssssssssssssssssssssssssssssssssssssssssssssssssssssss S s S S s S S. US 2015/0172400 A1 Jun. 18, 2015 MANAGEMENT OF 0010 Actual usage becomes critical in a reality where INFORMATION-TECHNOLOGY SERVICES applications are no longer selected by IT managers but by the users themselves, often without IT managers being asked or PRIORITY CLAIMAND CROSS-REFERENCE even being aware of their use within their enterprise. The IT TO RELATED APPLICATIONS asset management approach proposed by several vendors can help in managing Subscription assignment to users but cannot 0001. The present application claims priority from U.S. provide information on actual application usage. Almost by Provisional Application No. 61/939,123, filed Feb. 12, 2014, definition it cannot provide information on Subscriptions that and is a continuation of U.S. application Ser. No. 14/133,550, were not assigned by the same IT management. filed Dec. 18, 2013, which claims priority from U.S. Provi 0011. The current service-device paradigm doesn’t sional Application No. 61/739,623, filed Dec. 19, 2012. Each explain efficiently the IT world anymore since it ignores the of the aforementioned applications is incorporated by refer fact that users access applications through different devices ence as if fully set forth herein. and because it ignores the importance of actual usage. BACKGROUND Accordingly, it would be beneficial to have a system and/or method by which IT managers can easily measure and ana 0002 Traditional management of information technology lyZe SaaS usage across a company or other organization. (IT) processes is based on managing hardware and Software BRIEF DESCRIPTION OF THE DRAWING (HW and SW) running on premises. IT managers need to dimension networks, then servers, and then devices (work 0012 Preferred and alternative embodiments of the stations or PCs). Once the infrastructure is in place, their present invention are described in detail below with reference attention turns to the SW that must be installed on the infra to the following drawing figures. structure. In this scenario, SW versions are periodically 0013 FIG. 1 is a schematic view of an exemplary operat updated by the vendor and sold again as a new product. ing environment in which an embodiment of the invention can 0003 Primary challenges of managing traditional IT are be implemented; twofold: 0014 FIG. 2 is a functional block diagram of an exem 0004 Make sure the infrastructure keeps working at an plary operating environment in which an embodiment of the acceptable service level invention can be implemented; 0005. Select, maintain and update the SW 0015 FIG. 3 is a functional block diagram of an exem 0006. The univocal relation between SW and devices is so plary operating environment in which an embodiment of the strong that SW vendors to this day sell SW licenses based on invention can be implemented; the number of installations on PCs. Floating licensing is a 0016 FIGS. 4-6 illustrate alternative embodiments of the Software licensing approach in which a limited number of invention in which data may be collected; licenses for a software application are shared among a larger 0017 FIGS. 7-10 illustrate multiple graphic usage analy number of users overtime. When an authorized user wishes to ses that may be generated according to at least one embodi run the application they request a license from a central ment of the invention; and license server. If a license is available the license server 0018 FIG. 11 is a functional block diagram of an alterna allows the application to run. When they finish using the tive exemplary operating environment in which an embodi application, or when the allowed license period expires, the ment of the invention can be implemented. license is reclaimed by the license server and made available DETAILED DESCRIPTION OF THE PREFERRED to other authorized users. EMBODIMENT 0007. The advent of cloud computing has caused a signifi cant change in the way IT is managed in the enterprise, as SW 0019. This patent application is intended to describe one runs on remote servers and is accessed through browsers. or more embodiments of the present invention. It is to be Cloud computing is the use of computing resources (hard understood that the use of absolute terms, such as “must ware and software) that are delivered as a service over a “will.” and the like, as well as specific quantities, is to be network (typically the Internet). construed as being applicable to one or more of such embodi 0008 Responsibility for maintaining and upgrading SW ments, but not necessarily to all such embodiments. As such, moves to the SW vendors. Vendors manage also the servers embodiments of the invention may omit, or include a modi running their SW and as a result enterprise IT management fication of, one or more features or functionalities described responsibility is reduced only to make Sure internal users have in the context of such absolute terms. enough connectivity to the remote servers to guarantee a 0020. According to one or more embodiments, and as will smooth work and devices on which to connect. SW is sold as be discussed in greater detail below herein, a source of usage a service (SaaS Software as a Service): the most common data may include an external application programming inter model is the one of monthly subscriptions. face (API). The exposed API allows client entities, such as 0009. The vast majority of SaaS applications are sold Software developers, system integrators or partners, to cus under a “named subscription” model. This means that sub tomize and integrate an embodiment into their own SaaS Scriptions to SaaS applications are in reality assigned to Sub application instances, be they third party SaaS applications, scribers or users, real persons that are uniquely identified by custom add-ons to third party SaaS applications or even pro the vendor, usually through their e-mail address (a unique prietary in-house SaaS applications. identifier). SaaS applications run on remote servers and are (0021. By developing with the API, client entities will be accessed through a browser. Consequently, they can be able to let an embodiment collect additional data that may accessed through a vast range of devices. The traditional reside in off-site databases. This data can then be used on its univocal relation between user and device no longer applies. own or combined with other data collected in the customer's US 2015/0172400 A1 Jun. 18, 2015 instance of an embodiment and analyzed using analytics tools or implement particular abstract data types. Embodiments of employing principles of an embodiment. the invention may also be practiced in distributed-computing 0022. The API allows client entities to write (i.e., push) environments where tasks are performed by remote process data to one or more administrators of elements of at least one ing devices that are linked through a communications net embodiment. By employing the API, any SaaS application work. In a distributed computing environment, program mod can write its data to one or more administrators of elements of ules may be located in both local and remote computer at least one embodiment, without additional installation or storage media including memory storage devices. connection to a particular Software instance. (0029. With reference to FIG. 1, an exemplary system for 0023 This ability is useful for many reasons. For example, implementing an embodiment of the invention includes a for sensitive installs, the client entity need not worry about computing device, such as computing device 100. The com what data is being collected. For entities administering com puting device 100 typically includes at least one processing plicated applications that do not expose all their functionality unit 102 and memory 104. via their own API, this provides the ability of such entities to 0030 Depending on the exact configuration and type of write out whatever data they want analyzed. Consequently, computing device, memory 104 may be volatile (such as the client entity knows exactly what it is writing to a data random-access memory (RAM)), nonvolatile (such as read collecting administrator. An additional benefit to the client only memory (ROM), flash memory, etc.) or some combina entity is that an embodiment gives them better control of the tion of the two. This most basic configuration is illustrated in monitoring and tagging of events in a process. This can be FIG. 1 by dashed line 106. much more useful than Create/Read/Update/Delete (CRUD) 0031 Additionally, the device 100 may have additional triggers at the object level. features, aspects, and functionality. For example, the device 0024. When software is created, the creator typically 100 may include additional storage (removable and/or non “instruments' it. That is, the creator may log usage and per removable) which may take the form of, but is not limited to, formance data so that the creator can do, for example, bug magnetic or optical disks or tapes. Such additional storage is checks, performance management, etc. Considered in this illustrated in FIG. 1 by removable storage 108 and non manner, the API of at least one embodiment may be thought removable storage 110. Computer storage media includes of as allowing a client entity to remotely instrument directly volatile and nonvolatile, removable and non-removable to one or more administrators of elements of at least one media implemented in any method or technology for storage embodiment rather than to a log file locally. of information Such as computer-readable instructions, data 0025 Embodiments of the invention provide features structures, program modules or other data. Memory 104, including a universal mechanism to Support various authen removable storage 108 and non-removable storage 110 are all tication mechanisms introduced by cloud applications, envi examples of computer storage media. Computer storage ronment and convenient tools for IT people to manage cloud media includes, but is not limited to, RAM, ROM, EEPROM, applications Subscriptions and to provision and de-provision flash memory or other memory technology, CD-ROM, digital applications, device-independent usage tracking, location Versatile disks (DVD) or other optical storage, magnetic cas independent usage tracking, development tools, SOA, and settes, magnetic tape, magnetic disk storage or other mag open Source integration scripts with various cloud-applica netic storage devices, or any other medium which can be used tion vendors. to store the desired information and which can be accessed by 0026 FIG. 1 illustrates an example of a computing system device 100. Any such computer storage media may be part of environment 100 in which an embodiment of the invention device 100. may be implemented. The computing system environment 0032. The device 100 may also include a communications 100, as illustrated, is an example of a suitable computing connection 112 that allows the device to communicate with environment; however it is appreciated that other environ other devices. The communications connection 112 is an ments, systems, and devices may be used to implement vari example of communication media. Communication media ous embodiments of the invention as described in more detail typically embodies computer-readable instructions, data below. structures, program modules or other data in a modulated data 0027 Embodiments of the invention may be implemented signal Such as a carrier wave or other transport mechanism in hardware, firmware, software, or a combination of two or and includes any information delivery media. The term more of each. Embodiments of the invention may be opera "modulated data signal” means a signal that has one or more tional with numerous general-purpose or special purpose of its characteristics set or changed in Such a manner as to computing system environments or configurations. Examples encode information in the signal. By way of example, the of well-known computing systems, environments, and/or communication media includes wired media Such as a wired configurations that may be suitable for use with embodiments network or direct-wired connection, and wireless media Such of the invention include, but are not limited to, personal as acoustic, radio-frequency (RF), infrared and other wireless computers, server computers, hand-held or laptop devices, media. The term computer-readable media as used herein multiprocessor systems, microprocessor-based systems, set includes both storage media and communication media. top boxes, programmable consumer electronics, network 0033. The device 100 may also have an input device 114 PCs, minicomputers, mainframe computers, distributed com Such as keyboard, mouse, pen, Voice-input device, touch puting environments that include any of the above systems or input device, etc. Further, an output device 116 such as a devices, and the like. display, speakers, printer, etc. may also be included. Addi 0028 Embodiments of the invention may be described in tional input devices 114 and output devices 116 may be the general context of computer-executable instructions, such included depending on a desired functionality of the device as program modules being executed by a computer. Gener 1OO. ally, program modules include routines, programs, objects, 0034. According to one or more embodiments, the com components, data structures, etc. that perform particular tasks bination of Software or computer-executable instructions US 2015/0172400 A1 Jun. 18, 2015 with a computer-readable medium results in the creation of a the computer system. In an embodiment, the client device 210 machine or apparatus. Similarly, the execution of software or may bypass network 220 and communicate directly with computer-executable instructions by a processing device computer system 260. results in the creation of a machine or apparatus, which may 0040 FIG. 3 illustrates a system 310 according to an be distinguishable from the processing device, itself, accord embodiment of the invention, and the elements illustrated in ing to an embodiment. FIG.3 may be identical, or otherwise function in a manner 0035 Correspondingly, it is to be understood that a com similar, to elements described above with reference to FIG. 2. puter-readable medium is transformed by storing software or System 310 includes an application adaptor 320, serving as a computer-executable instructions thereon. Likewise, a pro collection module, a memory device. Such as a storage mod cessing device is transformed in the course of executing soft ule 330, and a processing module (processor) 340. As will be ware or computer-executable instructions. Additionally, it is discussed in greater detail below, the adaptor 320 is config to be understood that a first set of data input to a processing ured to interact with a set of client devices 360 employed by device during, or otherwise in association with, the execution end users and/or a plurality of software applications 370 (i.e., of software or computer-executable instructions by the pro SaaS applications) hosted on a network including one or more cessing device is transformed into a second set of data as a servers 380. In an embodiment, adaptor 320 is an application consequence of Such execution. This second data set may specific component that can be configured to recognize or Subsequently be stored, displayed, or otherwise communi otherwise discover the object model of and operation(s) that cated. Such transformation, alluded to in each of the above can be applied on specific object types by a targeted applica examples, may be a consequence of, or otherwise involve, the tion 370. Additionally, adaptor 320 is configured to convert physical alteration of portions of a computer-readable the specific object language of application 370 into a generic medium. Such transformation, alluded to in each of the above model according to an embodiment. examples, may also be a consequence of, or otherwise 0041 Elements of one or more embodiments of the system involve, the physical alteration of, for example, the states of 310 may be situated behind a firewall 390 with respect to the registers and/or counters associated with a processing device servers 380, as is the case with the embodiment illustrated in during execution of software or computer-executable instruc FIG. 3. As also shown in FIG. 3, adaptor 320 may be posi tions by the processing device. tioned on either side of firewall 390 relative to the monitored 0036. As used herein, a process that is performed “auto end users 360. Alternatively, elements of a unitary embodi matically may mean that the process is performed as a result ment of the adaptor 320 may be configured to “straddle' the firewall 390. of machine-executed instructions and does not, other than the establishment of user preferences, require manual effort. 0042. In the illustrated embodiment, the adaptor 320 is configured to collect data characterizing usage (“usage data') 0037 Referring now to FIG. 2, an embodiment of the of the SaaS applications 370 hosted on the one or more present invention may take the form, and/or may be imple servers 380 by the end users employing the client devices 360. mented using one or more elements, of an exemplary com The collected data is Subsequently stored in the storage mod puter network system 200. The system 200 includes an elec ule 330. As will be discussed in greater detail below, the tronic client device 210. Such as a personal computer or processor 340 is configured to determine, based on the stored workstation, tablet or Smartphone, that is linked via a com data, at least one usage rating for each of the client devices munication medium, Such as a network 220 (e.g., the Inter 360 (i.e., end users) and/or plurality of software applications net), to an electronic device or system, Such as a server 230. 370. The determined usage rating is then made viewable via The server 230 may further be coupled, or otherwise have an output device 350, such as a display or printer, for example. access, to a database 240 and a computer system 260. 0043. The type of usage data collected by the adaptor 320, Although the embodiment illustrated in FIG. 2 includes one as well as the manner in which Such data is collected, may server 230 coupled to one client device 210 via the network vary depending the particular embodiment employed. For 220, it should be recognized that embodiments of the inven example, referring to FIG. 4, an adaptor 320A of an embodi tion may be implemented using one or more Such client ment may include a plugin handler 410 and a Representa devices coupled to one or more such servers. tional State Transfer (REST) API handler 420 configured to 0038. The client device 210 and the server 230 may respectively and communicatively interface with a plugin 430 include all or fewer than all of the features associated with the and REST API 440 associated with an application 370. Such device 100 illustrated in and discussed with reference to FIG. an arrangement enables the adaptor 320A to collect directly 1. The client device 210 includes or is otherwise coupled to a from an application 370 data characterizing the usage of Such computer screen or display 250. The client device 210 may be application by one or more client devices 360. used for various purposes such as network- and local-com 0044) Referring now to FIG. 5, an adaptor 320B of an puting processes. embodiment may include a network agent handler 510 and a 0039. The client device 210 is linked via the network 220 log agent handler 420 configured to respectively and commu to server 230 so that computer programs. Such as, for nicatively interface with one or more network agents 540 and example, a browser, running on the client device 210 can log processing agents 550 associated with a local-area net cooperate in two-way communication with server 230. The work (LAN)530 of which the client devices 360 are constitu server 230 may be coupled to database 240 to retrieve infor ent elements. Such an arrangement enables the adaptor 320B mation therefrom and to store information thereto. Database to collect data characterizing the usage of an application 370 240 may have stored therein data (not shown) that can be used by one or more client devices 360 from elements of the LAN by the server 230 to enable performance of various aspects of 530 (which may be behind a firewall 390 relative to a server embodiments of the invention. Additionally, the server 230 380 hosting the application) rather than the application itself. may be coupled to the computer system 260 in a manner 0045 Referring now to FIG. 6, an adaptor 320C of an allowing the server to delegate certain processing functions to embodiment may include a proxy handler 610 configured to US 2015/0172400 A1 Jun. 18, 2015 communicatively interface with the client devices 360 and VPN logs, firewall logs, network proxy services, application application 370. Such an arrangement enables the adaptor user email, and/or company billing systems. 320C to collect directly from one or more client devices 360 0051. The collected usage statistics may be unique for and application 370 data characterizing the usage of Such each application 370 and could include items such as: application by the one or more client devices. 0.052 1. number of logins, 0046 FIG. 11 illustrates a system 1110 according to an 0053 2. time since last login, alternative embodiment of the invention, and the elements 0054 3. total application usage time, illustrated in FIG. 11 may be identical, or otherwise function 0055 4. number of times an application object was read, in a manner similar, to elements described above with refer 0056 5. number of times an application object was written ence to FIGS. 2 and 3. System 1110 includes a collection or modified, module 1120, which may include a memory device. Such as a 0057 6. number of bytes sent/received, storage module 330, and a processing module (processor) 0.058 7. number of packets sent/received. 340. As will be discussed in greater detail below, the collec 0059. The multiple methods of collection allow one or tion module 1120, in a manner at least analogous to that of more embodiments to capture data across a variety of client adaptor 320, is configured to interact with a set of client devices 360 and/or through integration with SaaS vendors devices 360 employed by end users and/or a plurality of logs and associate with specific users, resulting in device- and software applications 370 (i.e., SaaS applications) hosted on location-independent usage statistics. a network including one or more servers 380. System 1110 0060 All usage data collected by adaptor 320 may be may further include an application programming interface stored in storage device 330 for future retrieval and analysis. (API) 1130 and an instrumenting SaaS application 1140. Storage device 330 may consist of one or more of a relational database, “NoSql' type database, and flat files. Given the 0047 Elements of one or more embodiments of the system variety of SaaS applications 370 and data types collected, an 1110 may, but need not, be situated behind a firewall 390 with embodiment may use Some combination of semi-structured respect to the servers 380, as is the case with the embodiment or unstructured data stores Such as NoSql databases and flat illustrated in FIG. 11. files. 0.048. In the illustrated embodiment, the collection mod 0061. In an embodiment, data stored in device 330 is ana ule 1120 is configured to collect data characterizing usage lyzed and formatted by an analytic engine, according to an (“usage data') of the SaaS applications 370 hosted on the one embodiment, executed by processor 340 and using metadata or more servers 380 by the end users employing the client associated with applications 370 and/or a behavioral model devices 360, which may all belong to a client entity (not associated with one or more of end users 360. Such data may shown). In an embodiment, this usage data is a Subset of a be retrieved and analyzed in a distributed manner. Given the more-complete data set describing use of client devices 360 semi-structured or unstructured nature of the data, in an and/or applications 370 that may otherwise be made available embodiment, techniques may include big data frameworks by the client entity. The API 1130 is configured to enable the such as MapReduce. client entity to define this data subset and proactively publish 0062) A variety of usage analytics may be computed for (i.e., push), without enabling response to requests for (i.e., applications 370: pulling of), the data subset to the collection module 1120, 0063 1. on an individual application basis, thereby giving the client entity much greater control over 0064. 2. combined across multiple applications, and/or what data is provided and what data is not. The instrumenting 0065 3. combined across company departments or busi SaaS application 1140 is configured to instrument other SaaS ness units. applications 370. Application 1140 can collect data regarding 0066. These usage analytics can be computed and/or how applications 370 are being used, such as who is using the monitored over time by processor 340 allowing for usage applications, how much the applications are being used, trend analysis. A usage rating for each application may be which parts of those applications are being used, which computed based on collected Statistics pertaining to an appli objects are being used, etc. This information can be used, cation 370. This usage rating may be different for each appli firstly, to measure adoption, and secondly to measure user cation 370. behavior to enable the client entity to make more informed 0067. An exemplary calculation of Sucha usage rating is in decisions on which applications to make available and to the case where the statistics of interest are: whom they should be made available. 0068 1. L-number of logins, 0049. The collected data is subsequently stored in the stor 0069 2. R-number of read accesses. age module 330. As will be discussed in greater detail below, (0070) 3. W=number of write/modify accesses. the processor 340 is configured to determine, based on the 0071. An embodiment may classify an application user stored data, at least one usage rating for each of the client 360 over a specified unit time period (e.g., one day) as fol devices 360 (i.e., end users) and/or plurality of software appli lows: cations 370. The determined usage rating is then made view (0072 1. Full Access User: if (L>0, Wid-0) then FA-1, else able via an output device 350, such as a display or printer, for FA=0, example. 0073 2. Read Only User: if (L>0, R>0, W=0) the RO=1, 0050. The embodiments illustrated and described above else RO=0, are configured to collect a variety of usage statistics from (0074) 3. Non User: if (L=0) then NU=1, else NU=0. multiple SaaS applications 370. As above alluded to, these 0075 Consequently, simple usage statistics can be pre statistics may come from the SaaS applications themselves, sented by output 350 on an absolute or percent basis, as are via communication directly with the application, application illustrated in FIGS. 7 and 8, respectively. REST APIs or application plugins, agents monitoring net 0076 An embodiment can also compute a normalized work traffic, system logs, application logs, network logs, usage rating that allows for easier comparison between appli US 2015/0172400 A1 Jun. 18, 2015 cations. For a given user, Ux, a usage rating for that user 360 (0095 of can be in the range of 1...9 over N number of unit time periods can be computed accord (0096) can be represented by Day, Week, Month ing to Equation 1: 0097. Each criterion is represented by text description, which is shown in the UI. 0.098 Solution provides users with a set of predefined W (1) criteria, Such as U = 1/NX (10s FA; +5s RO) 0099 at least once a day—(1 in 1 day) 0100 at least once a week—(1 in 1 week) 0101 at least once a month—(1 in 1 month) 0077. Note that, in alternative embodiments, the factors 10 0102 at least twice a week (month)—(2 in 1 week) and 5 in the above formula could be replaced with arbitrary 0103 at least three times a week (month)—(3 in 1 week) weighting factors to set overall scale and relative weight. A 0104 at least one login every second day—(1 every 2 usage rating for the organization with Mapplication users 360 days) may be computed according to Equation 2: 0105 once a while (0 in any period) 0106 others 0107. In the first version of the product an embodiment i (2) provides customers with a wide range of predefined Usage Uotal = 1/MXU, Utilization criteria. Customers are allowed to define their own Usage Utilization criteria. 0.108 Calculation Algorithm 0078. This provides an organization-wide usage rating for 0109 The following is one of the possible algorithms that application on a scale of 0-10. according to an embodiment to calculate Usage Index and Activity Level per application/application assignee: 0079 Similar “normalized usage ratings can be devel 0110 1. Calculate DayCriterion by normalizing expected oped for each application370 being managed and those usage criteria to Daily representation. For example: ratings combined to give an overall company-wide SaaS 0111. Once a day=1 usage rating, as is illustrated in FIG. 9. 0112. Once a Week=1/NoOfWorkDaysaWeek=0.2 0080. In the case of SaaS application “mashups', whereby 0113 Twice a Week=2/NoOfWorkDaysaWeek=0.4 different SaaS applications are combined to create a new 0114. Note: only working days are taken into consider SaaS application, an embodiment can combine usage analyt ation according to an embodiment. ics of the underlying applications to create new usage analyt 0115 2. Calculate DayLogins of the user number of log ics for the mashup application. ins normalized to one day. 0081. In an alternative embodiment, average accumulated 0116 DayLogins—NoOfLogins.InPeriod oOfWork Usage Index and Activity Level (KPIs) may be calculated and DaysInPeriod (see also DayLogins calculation below). stored, as follows: 0117 3. Usage Index is calculated as: 0082 Per application assignee—user having direct assignment of application Subscription. Calculated Usage UsageIndex=DayLogins/DayCriterion* 100% Index and Activity Level are kept in the object of application 0118 4. Activity Level is equal to: Subscription. 0119 a. High Utilization. If UsageIndex>75% 0.083 Average per user for all assigned applications—sum I0120 b. Medium Utilization if 25%>=UsageIn of corresponding KPI per applications divided by number of dex=<75% assigned applications. Calculated average Usage Index and I0121 c. Low Utilization if UsageIndex<25% Activity Level are kept in the User object. 0.122 NoCfILogins.InPeriod is taken from the System log 0084 Average per User Group for all applications—is for all days—working and not working. Several logins within calculated as an average between all members with utilization one day should be represented by “1”. criterion other than 0. Calculated average Usage Index and I0123 DayLogins Calculation Activity Level are kept in the User Group object. 0.124. Accumulated criterion per application and applica 0085 Average per application—average of all assign tion assignee is represented in the corresponding Subscrip ees—users divided by the number of assignees. Calculated tions object in the following five fields: average KPIs are kept in the Application object. (0.125 Usage Index 0.086 Average per organization—average of all applica (0.126 Activity Level tion assignees (sum of all Subscriptions that should undergo I0127. No of working days in statistic sample calculation divided by number of such subscriptions) I0128 No of logins in a sample 0087 Subscriptions that should undergo calculation are I0129. Start Sample date those subscriptions that have assignee with utilization crite 0.130. To calculate accumulated KPIs, an embodiment cal rion other than Zero (0). culates accumulated DayLogins by: 0088 Criteria Definition I0131 Incrementing number of working days in statistic I0089 Criteria may be provided in the form of predefined sample (only for working days); templates: 0.132. Incrementing number of logins in a sample in case 0090 Template 1: there was at least one login of the assignee within the calcu lation day 0091 working days in statistic sample is still less than “expected 0094) Year No of work information for analysis by processor 340. ing days in statistic sample:=0 and No of logins in a sample: 0158 An embodiment may be configured to generate a list =O. of "known users' against which to compare collected data. 0.136 Calculation Job This could be achieved by examining a user database Such as 0.137 Job that calculates average accumulated KPIs may Active Directory or LDAP, which would then be compared to run for every organization's time Zone at midnight. For non the discovery described above. Reports to output device 350 working days the job may behave differently for the two may then be generated. One class of reports could then be following cases: based on SaaS usage that does not match with this list of users. 0138 If assignee did not login an application, job may not 0159. At the network level, there may be complications recalculate the KPIs for corresponding application. with seeing exactly what users are doing but an embodiment 0139 If assignee logged in at least once, job may calculate can arrive at one type of usage stats based simply on the traffic KPIs without incrementing the No. of working days in statis Volume (either packets or bandwidth) associated to each user tic sample. 360 of a particular application 370. This usage or activity 0140. In an embodiment, customers (i.e., an organization mapping may be different for each application 370 and may of which end users 360 are constituents) will have access to involve some research to determine. their own detailed usage analytics. An embodiment can pro (0160. An embodiment includes a method to discover vide benchmarking and targeted usage goals for customers. which paid applications are in use within the organization by An embodiment may be able to combine this information users 360. The basic consideration is that every SaaS provider with SaaS license pricing to provide customers with internal sends periodic invoices to its customers via email; invoices SaaS spending budget allocation: to departments, locations are obvious proof of the organization using a service. With a and business units. customer's permission, and by searching a customer's entire 0141. In addition to computing and reporting usage ana mail server, an embodiment may extract information about lytics for individual customers, an embodiment may compute which SaaS applications 370 have been contracted for by end analytics involving multiple customers usage data in an ano users 360 at that customer. One such embodiment is by com nymized fashion. This allows an embodiment to: paring an email database to invoice emails sent by known 0142 catalog which SaaS applications are in use, SaaS vendors. An embodiment may then find SaaS services 0143 determine how applications rank relative to their contracted for, and match them to users 360 (the users to competitors, overall and in Vertical markets, which the emails are addressed). Those users 360 are also the 014.4 quantify “Industry Best Practices' relating to SaaS “internal owners' of those services, because they are the application usage, billing counterparty for the SaaS vendor. 0145 provide customers with their relative industry rank 0.161. An embodiment is able to recognize invoices sent by ing and recommendations for improvements, specific vendors. The output may be a list of all those invoices 0146 show favorite applications for specific functions that an embodiment recognizes that are from SaaS vendors across enterprises, providing services to the organization. An embodiment may 0147 market and sell aggregated usage data for specific extract at least some minimal information from the content of applications or for classes of applications, to be used as ref the invoices, such as the total amount due and invoice date. erence to compare performance levels by enterprises and/or 0162 An embodiment may also be able to determine the for auditing purposes, number of licenses purchased, their duration or renewal and 0148 discover SaaS applications or usage unknown to other relevant data. company. 0163. In an embodiment, email received in the past year is 0149. An embodiment may determine who is using an screened since all vendors, even the ones with a multi-year application for purposes of identifying who are the existing plan, send at least one invoice a year to their customers. An users of each unknown (or even known) application370. Such embodiment then collects this information and presents it to function may provide information about how many users 360 customers after the initial analysis and without need to wait there are for each application 370 and about their volume of for a customer to run an embodiment for a few weeks in order uSage. to perceive some value. It would also prove history of billing 0150. As alluded to above herein, methods to achieve this for the same customer by the vendors. functionality may, according to one or more embodiments, be 0164. In short, an embodiment may present a list of users as follows: 360, a detail of the applications 370 in use and the amount 0151 1. Examining network traffic, an embodiment could spent in the past and/or forecast to be spent in the future. “discover users that were not in the official licensing of the 0.165 An embodiment monitors what applications 370 are company; for example, an employee that purchased a license being used to enable customers to improve their efficiency individually using a credit card. and spending. 0152 2. Examining logs from firewalls to see which appli 0166 An embodiment provides analytics and reporting cations 370 were being accessed from which devices 360 and related to the utilization of SaaS licenses, which will help geolocating those devices. companies with budgeting and expense control. 0153. 3. Examining logs from routers for the same pur 0167. An embodiment may collect and store SaaS appli pose. cation user and matching license information. Linking this 0154 4. Examining VPN logs for the same purpose. data with usage analytics will allow for advanced Subscrip US 2015/0172400 A1 Jun. 18, 2015 tion management including addition/removal of licenses, completely separated from a logical point of view and not assignment of licenses, license renewals, reporting of unused able to see each other, while on the other hand the SI shall be licenses, and reporting of improperly assigned or allocated limited in viewing usage only for a subset of the Enterprises licenses. applications. Example: a Google Applications SI can see 0168 An embodiment can compute a license spending usage for all his customers using Google Applications but not efficiency that shows how much SaaS spending of the orga Salesforce usage. nization that includes users 360 is remaining idle at any given 0177. By integrating directly with the SaaS applications time and help them plan to minimize the waste, as is illus 370 using customers’ credentials, an embodiment may sync trated in FIG. 10. the users 360 and be able to provision and de-provision users. 0169. An embodiment may collect and store SaaS appli This is a lightweight provisioning system that completely cation 370 pricing models. This information may come from bypasses the traditional SSO-Identity Management model. In multiple sources including publically available sources and addition, once an embodiment uniquely identified a user 360 anonymized information from customer licensing data. An through his/her email address (the unique identifier) an embodiment can then provide a variety of analytics on these embodiment can then connect/provision that user to any SaaS pricing models and how they impact a customer's application 370 an embodiment is integrating with resulting deployments. Two examples include computing the optimal in automatic lightweight two-way provisioning. cost of an application for a company based on usage and (0178 While the preferred embodiment of the invention computing the optimal cost for multiple applications in the has been illustrated and described, as noted above, many same category (e.g., showing a company their optimal changes can be made without departing from the spirit and deployment of three different SaaS storage applications 370 Scope of the invention. Accordingly, the invention is not lim based on the available licensing and types of usage across the ited except as by the appended claims. company). What is claimed is: 0170 An embodiment may provide mechanisms for pro 1. At least one computer-readable medium on which are visioning/de-provisioning users on the managed SaaS appli stored instructions that, when executed by at least one pro cations 370. This provisioning information could be entered cessing device, enables the at least one processing device to into an embodiment directly or it could come through inte perform a method comprising the steps of: gration with user databases such as Active Directory or providing an application programming interface (API) to a LDAP client entity; (0171 An embodiment may provide employee lifecycle receiving with a collection module a data subset of a data management of SaaS applications 370. An embodiment may set, the data Subset characterizing usage, by users of a set monitor employees’ status at the company via their SaaS of client devices of the client entity, of a plurality of provisioning and usage. An embodiment may be able to pro Software applications hosted on a network, wherein the vide reports and alerts if for example, an employee is de API is configured to enable the client entity to define the provisioned in one or more applications 370, as that may be a data subset and push the data subset to the collection sign they have left the company and they need to be de module; provisioned in other applications. storing the received data Subset; and 0172 An embodiment may use the data collected from determining, based on the stored data Subset, at least one within an organization, in order to benchmark that organiza usage rating for each of the plurality of Software appli tion to others. This will show the organization where it stands cations. with respect to its efficiency in utilizing SaaS applications as compared to its peers. 2. The medium of claim 1, wherein the usage rating indi 0173 An embodiment may include “time and motion' cates type of usage by a client device of the set of client analysis. A large component of the cost of software is, besides devices of a single Software application of the plurality of the licensing cost, the cost of the time spent by its users. An Software applications. embodiment may measure how efficient software is at 3. The medium of claim 1, wherein the usage rating indi enabling users to do their jobs. For example, what is the cates type of usage by the set of client devices of a single optimal time spent by a salesperson on salesforce.com? This Software application of the plurality of software applications. is because the cost of a salesforce.com license is not just the 4. The medium of claim 1, wherein the data is received up-front software cost, but also the cost of the time spent by from logs associated with a firewall. salespersons entering data and looking up reports. How much 5. The medium of claim 1, wherein the data is received via input does the software require and at what cost? For this cost direct communication with the plurality of Software applica of input, what outputs does the software enable'? tions. 0.174 Due to provisioning capabilities, an embodiment 6. The medium of claim 1, wherein the usage rating is may enable users not just to bring their own devices (BYOD), determined using metadata specific to each Software applica but also allow them to choose which SaaS applications they tion of the plurality of software applications. prefer to get their jobs done (BYOS-Bring your own SaaS). 7. A system, comprising: 0175 To the extent that more than one user is using a SaaS an application programming interface (API); application in read-only mode, an embodiment may provide a a collection module configured to receive a data Subset of a means for all those users to share one login, thus enabling the data set, the data Subset characterizing usage, by users of organization to cut down on its software costs. a set of client devices of a client entity, of a plurality of 0176 An embodiment may provide usage analytics ser Software applications hosted on a network, wherein the vices to multiple customers. In this case a system integrator API is configured to enable the client entity to define the (SI) will have a higher-level view of usage of applications by data subset and push the data subset to the collection several of its enterprise customers. SI’s customers have to be module; US 2015/0172400 A1 Jun. 18, 2015 a data-storing module configured to store the received data receiving a data Subset of a data set, the data Subset char Subset; and acterizing usage, by users of a set of client devices of the a processing module configured to determine, based on the cliententity and on one side of a firewall, of a plurality of stored data Subset, at least one usage rating for each of software applications hosted on the other side of the the plurality of Software applications. firewall, wherein the API is configured to enable the 8. The system of claim 7, wherein the usage rating indicates client entity to define the data subset and push the data type of usage by a client device of the set of client devices of Subset to the collection module: a single Software application of the plurality of Software storing the received data Subset; and applications. determining, based on the stored data Subset, at least one 9. The system of claim 7, wherein the usage rating indicates usage rating for each of the plurality of Software appli type of usage by the set of client devices of a single Software cations. application of the plurality of Software applications. 14. The medium of claim 13, wherein the usage rating 10. The system of claim 7, wherein the data is received indicates type of usage by a user of a single software appli from logs associated with a firewall. cation of the plurality of Software applications. 11. The system of claim 7, wherein the data is received via 15. The medium of claim 13, wherein the usage rating direct communication with the plurality of Software applica indicates type of usage by the set of users of a single Software tions. application of the plurality of Software applications. 12. The system of claim 7, wherein the usage rating is 16. The medium of claim 13, wherein the data is received determined using metadata specific to each Software applica from logs associated with the firewall. tion of the plurality of software applications. 17. The medium of claim 13, wherein the data is received 13. At least one computer-readable medium on which are via direct communication with the plurality of software appli cations. stored instructions that, when executed by at least one pro cessing device, enables the at least one processing device to 18. The medium of claim 13, wherein the usage rating is perform a method comprising the steps of: determined using metadata specific to each Software applica providing an application programming interface (API) to a tion of the plurality of software applications. client entity; k k k k k