Cisco Technology, Inc.

Jackson Ngoc Ki Pang

Navindra Yadav

Hai Trong Vu

Shashidhar R Gandham

Shih-Chun Chang

Anubhav Gupta

Abhishek Ranjan Singh

Ashutosh Kulshreshtha

Supreeth Hosur Nagesh Rao

Khawar Deen

Michael Standish Watts

Varun Sagar Malhotra

Omid Madani

Sunil Gupta

Roberto Fernando Spadaro

Ali Parandehgheibi

Ellen Christine Scheib

Rohit Chandra Prasad

Hoang Viet Nguyen

Vimalkumar Jeyakumar

Bharathwaj Sankara Viswanathan

Fnu Rachita Agasthy

Duane Thomas Barlow

Mohammadreza Alizadeh Attar

Aria Rahadian

Supreeth Rao

Darshan Shrinath Purandare

Aiyesha Ma

Prasannakumar Jobigenahally Malleshaiah

Tapan Shrikrishna Patwardhan

Preethi Narayan

Vishal Jaswant Thakkar

Zhiwen Zhang

Sunil Kumar Gupta

Systems, methods, and computer-readable media for updating configurations in sensors deployed in multi-layer virtualized environments. In some examples, a system can track information of sensors and collectors in the network. In response to determining that a specific collector becomes unavailable (e.g., the specific collector is down, offline or becomes unsupported), the system can determine affected sensors corresponding to the specific collector, determine a new collector among active collectors of the network for each of the affected sensors, and dynamically update configuration and settings of the affected sensors to maintain proper collector-to-sensor mappings and other settings on the affected sensors.

Auto update of sensor configuration

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

Unique ID generation for sensors

Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Technologies for managing compromised sensors in virtualized environments

Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Technologies for annotating process and user information for network flows

An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.

Application monitoring prioritization

Growing community of inventors

Sunnyvale, CA, United States of America

Jackson Ngoc Ki Pang