Hewlett Packard Enterprise Development LP

Fortinet, Inc.

David Nellinger Adamson

Larry Lancaster

Raymond Mark Cooke

Aditya Samalla

Yijou Chen

Gurunatha Karaje

Isha Singhal

Andrew D Twigg

Ting-Fang Yen

Vladimir Semitchev

Guoli Sun

Roderick Bagg

Data platforms described herein are configured to monitor a compute environment and to create and present composite events indicative of multifaceted security threats within the compute environment. Such a data platform may detect both a first event that occurs within the compute environment and is associated with a first alert score and a second event that occurs within the compute environment and is associated with a second alert score. The data platform may then identify an affiliation between the first event and the second event based on a predefined criteria of a multifaceted security threat. Based on the identifying of the affiliation, the data platform may present the first and second events as a composite event indicative of the multifaceted security threat and associated with a third alert score different from the first and second alert scores. Corresponding methods, systems, and products are also disclosed.

Composite events indicative of multifaceted security threats within a compute environment

In some examples, a system identifies a potential issue based on comparing measurement data acquired at different hierarchical levels of a computing environment. Within a hierarchical level of the different hierarchical levels, the system determines, based on measurement data acquired for objects in the hierarchical level, whether the potential issue is localized to a subset of the objects.

Localization of potential issues to objects

An assessment of computing system performance may include evaluating, within a time window, the average latency of operations of a certain type and size with respect to a peer performance model constructed for operations of the same type and size. Such evaluation may result in the determination of a peer performance score. The peer performance score may be used to label performance characteristics of the computing system that are measured within the same time window. A library of such performance characteristics labeled with respective peer performance scores may be constructed by examining multiple computing systems, and such library may be used to construct one or more symptom models. Each symptom model may map a performance characteristic to a symptom severity score, which indicates the severity of a symptom of the computing system.

Methods and systems for characterizing computing system performance using peer-derived performance severity and symptom severity models

Methods and systems for enabling sizing of storage array resources are provided. Resources of a storage array can include, for example, cache, memory, SSD cache, central processing unit (CPU), storage capacity, number of hard disk drives (HDD), etc. Generally, methods and systems are provided that enable efficient predictability of sizing needs for said storage resources using historical storage array use and configuration metadata, which is gathered over time from an install base of storage arrays. This metadata is processed to produce models that are used to predict resource sizing needs to be implemented in storage arrays with certainty that takes into account customer-to-customer needs and variability. The efficiency in which the sizing assessment is made further provides significant value because it enables streamlining and acceleration of the provisioning process for storage arrays.

Methods and systems for determining hardware sizing for storage array systems

A flaw classifier model classifies a computing system as one which contains or does not contain one or more flaws that affect a performance of the computing system. Inputs to the flaw classifier model may include an actual utilization of a resource of the computing system and an expected utilization of the resource of the computing system. The expected utilization of the resource may be determined by an expected resource utilization model. Inputs to the expected resource utilization model may include workload description parameter values and hardware description parameter values.

Growing community of inventors

Oakland, CA, United States of America

David Nellinger Adamson