Nutanix, Inc.

Fortinet, Inc.

Isha Singhal

Venkata Vamsi Krishna Kothuri

Matthew James Armstrong

Yijou Chen

Akshay Narayan Muramatti

Anurag Choudhary

Andrew D Twigg

Yiran Deng

Ting-Fang Yen

Praveen Uday Bhaskara Pisipati

Prashant Batra

David Nellinger Adamson

Mukesh Sohanlal Bafna

Arvind Mohan

Shi Shu

Zhuoran Li

Amarsinh Vijaysinh Patil

Sameer Narkhede

Sowmya A Karmali

Ashish Ramdas Mankar

Nikita Vishwanath Shetty

Data platforms described herein are configured to monitor a compute environment and facilitate interactive analysis of multifaceted security threats within the compute environment. Such a data platform may determine that one or more assets within the compute environment are possibly being targeted by a multifaceted security threat and present an interactive user interface. The user interface may be configured to display an identifier indicative of the multifaceted security threat, a set of selectable evidence items each associated with a different facet of the multifaceted security threat and assessed based on the monitoring of the compute environment, and a presentation pane for displaying information. As such, the data platform may detect a selection of a particular evidence item from the set of selectable evidence items and, in response to the selection, populate the presentation pane with information related to the particular evidence item. Corresponding methods, systems, and products are also disclosed.

Interactive analysis of multifaceted security threats within a compute environment

Data platforms described herein are configured to monitor a compute environment and to create and present composite events indicative of multifaceted security threats within the compute environment. Such a data platform may detect both a first event that occurs within the compute environment and is associated with a first alert score and a second event that occurs within the compute environment and is associated with a second alert score. The data platform may then identify an affiliation between the first event and the second event based on a predefined criteria of a multifaceted security threat. Based on the identifying of the affiliation, the data platform may present the first and second events as a composite event indicative of the multifaceted security threat and associated with a third alert score different from the first and second alert scores. Corresponding methods, systems, and products are also disclosed.

Composite events indicative of multifaceted security threats within a compute environment

Time series anomaly detection, including: gathering data associated with a particular event type and a particular user; generating, based on the data, a time series analysis; detecting an anomaly based on the time series analysis; and generating information describing the anomaly.

Time series anomaly detection

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to receive, at a node of a cluster on an edge network, an indication that the cluster received a configuration update, compare a first parameter of a configuration state of the node to a second parameter of the configuration update, determine if the first parameter matches the second parameter, in response to determining that the first parameter matches the second parameter, apply the configuration update, and collect data in accordance with the configuration update.

Edge side filtering in hybrid cloud environments

Various embodiments disclosed herein are related to an apparatus. In some embodiments, the apparatus includes a processor and a memory. In some embodiments, the memory includes instructions that, when executed by the processor, cause the apparatus to collect, at a cloud server, service data from a collector framework service of an edge network. In some embodiments, the memory includes instructions that, when executed by the processor, cause the apparatus to provide a configuration to the collector framework service based on the service data.

System and method for managing clusters in an edge network

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to classify, on a cloud server, a plurality of clusters of an edge network based on one or more classification parameters, detect that a first cluster in a first datacenter of the edge network has an issue, determine a classification parameter value of the first cluster, determine that a second cluster in a second datacenter of the edge network has a second classification parameter value within a predetermined amount of the classification parameter value, and send an instruction to the second cluster to perform a remediation action.

Recommendation engine based on classification of virtualized workload

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to detect, on a cloud server, an indication to collect additional data from a cluster on an edge network coupled to the cloud server, send, to the cluster, a command to receive a command output, indicate, to the cluster, to send the command output as a type of data including at least one of raw data or parsed data, receive the command output in accordance with the command and the type of command output, and troubleshoot an issue of the cluster based on the command output.

Handling dynamic command execution in hybrid cloud environments

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to detect, on an edge network, a state change of a cluster including one or more edge processing units, identify a plurality of first configuration override rules from a first source and a plurality of second configuration rules from a second source, merge at least one first configuration override rule with at least one second configuration override rule to generate a plurality of third configuration override rules, update a configuration of the one or more edge processing units using the plurality of third configuration override rules, and collect data from the one or more edge processing units in accordance with the configuration update.

Intelligent telemetry data collection

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to detect, on a server, a first symptom observable on a first one or more clusters. In some embodiments, the first symptom is indicative of an issue. In some embodiments, the instructions cause the processor to trigger additional data collection by a plurality of edge processing units for the first one or more of clusters, detect, in a second one or more clusters within the first one or more clusters, a second symptom indicative of the issue, and generate a remediation action for a third one or more clusters having the first symptom and the second symptom. In some embodiments, the second one or more clusters include the third one or more clusters.

Smart collection and processing in telemetry system

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to identify a first cluster and a second cluster. In some embodiments, each of the first cluster and the second cluster is on an edge network. In some embodiments, each of the first cluster and the second cluster has an issue. In some embodiments, the instructions cause the processor to send a first configuration update to the first cluster and, in response to determining that the issue is or is not resolved in the first cluster, send the first configuration update to the second cluster or change the first configuration update on the first cluster, respectively.

Cloud-controlled configuration of edge processing units

Various embodiments disclosed herein are related to a non-transitory computer readable storage medium. In some embodiments, the medium includes instructions stored thereon that, when executed by a processor, cause the processor to receive, on a cloud server coupled to a cluster on an edge network, a configuration state of the cluster, map the configuration state to a list of streams, send, to the cluster, the list of streams, and receive an indication that the cluster subscribed to the list of streams.

Growing community of inventors

Milpitas, CA, United States of America

Isha Singhal