Palo Alto Networks, Inc.

Cisco Technology, Inc.

Vmware, Inc.

Nicira, Inc.

Gaurav Sharma

Ramanathan Lakshmikanthan

Sameer Dilip Merchant

An-Chun Chang

Anupam Bharali

Medhavi Dhawan

Srinivas Neginhal

Prasad Sharad Dabak

Rajneesh Bajpai

Ravi Singhal

Praveen Tiwari

Hai Lin

Manish Sampat

Ali Parandehgheibi

Didac De La Iglesia

Jagdish Shinde

Suresh Venkataraman

Alina Asish Rath

Christopher Nicholas Ganas

Prem Jayaraj

The present application discloses a method, system, and computer system for managing policy configurations. The method includes (i) receiving a set of predefined security policy rules, (ii) determining, based at least in part on the set of predefined security policy rules, one or more security policy rules that do not satisfy one or more predefined requirements, (iii) performing a priority or position analysis to determine a relationship among a plurality of security policy rules, and (iv) providing a report pertaining to the one or more security policy rules.

Cyber twin of NGFW for security posture management

A system as disclosed herein analyzes unresolved vulnerabilities against current configurations of devices of a network to generate an impact analysis report which provides a comprehensive view of the impact of the vulnerabilities on the network. This provides a manageable perspective of risk assessment and remediation for the network. To maintain a current view of device configurations, telemetry data streams are collected from the devices. A listing of outstanding or unresolved cybersecurity vulnerabilities is also maintained. When an analysis trigger is detected, the system extracts values of configuration properties for devices from the telemetry data streams and analyses them against the list of vulnerabilities to determine devices affected by the vulnerabilities. Tracking data are maintained according to the determinations of affected devices across vulnerabilities. This data is aggregated into an impact report that indicates impact of vulnerabilities to the network.

Network tailored vulnerability impact assessment

For a seamless and robust artificial intelligence-based assistant experience, an intent-based query and response router has been designed to operate as an intelligent layer between a user and multiple backend services that may respond to one or more queries over the course of a conversation with the user. The query router interacts with an intent classification service to obtain an intent classification for a prompt that is based on a user query. The query router uses the intent classification, which is used as an identifier of a backend service, to route the user query to an appropriate one (or more) of the backend services. When a response is detected, the query router determines a corresponding conversation and provides the response for the conversation.

Intent-based query and response routing between users and backend services

According to certain embodiments, a message bus system comprises a first client and a second client. The first client is configured to publish messages associated with a message topic to a message bus, and the second client is configured to receive the messages associated with the message topic from the message bus. The message bus system is configured to unsubscribe the second client from the message topic based at least in part on determining that a demand of the second client for the messages associated with the message topic has fallen below a threshold.

Reactive backpressure for East-West messaging in an embedded control cluster

Various aspects are disclosed for distributed application management using an embedded persistent queue framework. In some aspects, task execution data is monitored from a plurality of task execution engines. A task request is identified. The task request can include a task and a Boolean predicate for task assignment. The task is assigned to a task execution engine embedded in a distributed application process if the Boolean predicate is true, and a capacity of the task execution engine is sufficient to execute the task. The task is enqueued in a persistent queue. The task is retrieved from the persistent queue and executed.

Embedded persistent queue

Techniques for generating change notifications associated with applications based on application logs are disclosed. In one embodiment, a system may include a log analyzer to receive application logs generated by the applications running in a computing environment and analyze the received application logs to parse information about the applications. Further, the system may include a change detection unit communicatively coupled to the log analyzer to generate a change notification indicating that a change has been occurred to an application running on a compute node in the computing environment using the parsed information and send the change notification indicating the changed application to a subscriber.

Application change notifications based on application logs

Reactive backpressure for east-west messaging in an embedded control cluster

According to examples of the present disclosure, a method is provided to perform network introspection in an operating system that comprises a user memory space and a kernel memory space. The method may comprise, in response to an initiation of a socket operation, filtering the socket operation at a socket layer in the kernel memory space using a socket operation filter hook associated with the socket operation. The method may further comprise performing an introspection action associated with the socket operation filtered using the socket operation filter hook.

Network introspection in an operating system

Growing community of inventors

Mountain View, CA, United States of America

Gaurav Sharma