Juniper Networks, Inc.

Nadeem Khan

Mayank Betala

Rene Chavez

Andrew Stephen Chasin

Rakesh Manocha

Ahzam Ali

Pradeep Velappan Nair Pushkala Devi

Oscar Leonardo Bejarano Ardila

Lyubov Nesteroff

Chandan Kumar

Sanjay Agarwal

Amol Sood

Amarnath Bachhu Satyan

Lisa M Beam

Olga M Towstopiat

Firdousi Zackariya

Dharmendran Arumugam

Shrikanta Sharma

Anoop Kartha

Kamil Imtiaz

Natalia L Shimuk

Pradeep Vallappan Nair Pushkala Devi

A device receives a new rule construct that includes a source address or a destination address, and at least one parameter, where the new rule construct includes a new rule to be provided to a network. The device identifies network devices, of the network, to which the new rule is to be provided based on the new rule construct, and determines a proper position for the new rule, in a list of existing rules provided in each network device, based on the new rule construct and information associated with the network devices. The device causes the new rule to be provided to and stored in the network devices, at the proper position, in the list of existing rules, determined for each network device.

Rule placement in network devices

Techniques are described for optimizing the placement of automatically generated rules within security policies. An administrator may, for example, interact with the graphical representation of rules rendered by the threat control module and, responsive to the interaction, the system may determine an optimal placement for the created rule in the list of rules for the identified security device based on either the existence of anomalies or threat IP data and/or advanced security parameters. In this way, the system allows administrators to configure rules with the most optimal sequence to detect threats.

Integrated security system having rule optimization

Techniques are described for taking direct actions, such as selectively blocking or allowing traffic and applications, while monitoring events from a graphical representation of threats. As such, the administrator in an enterprise interacts with the graphical representation of threats rendered by the security management system to automatically invoke a policy/rule module of the security management system to configure and update security policies for the security devices deployed throughout the computer networks of the enterprise. An administrator may, for example, interact with the representation of threats rendered by the threat control module based on the data aggregated from the distributed security devices and, responsive to the interaction, the security management system may identify a relevant set of the security devices, automatically construct security policies having ordered rules within the policies for the identified set of security devices, and automatically communicate and install the policies in the identified set of security devices.

Integrated security system having threat visualization and automated security device control

An example network system includes a plurality of endpoint computing resources, a business policy graph of a network that includes a set of the plurality of endpoint computing resources configured as a security domain, a set of policy enforcement points ('PEPs') configured to enforce network policies, and a network management module ('NMM'). The NMM is configured to receive an indication of a set of network policies to apply to the security domain, automatically determine a subset of PEPs of the set of PEPs are required to enforce the set of network policies based on physical network topology information readable by the NMM that includes information about the location of the endpoint computing resources and the set of PEPs within the network, and apply the network policies to the subset of PEPs in order to enforce the network policies against the set of endpoint computing resources of the security domain.

Domain-based security policies

Growing community of inventors

Bengaluru, India

Nadeem Khan