Cisco Technology, Inc.

Strava, Inc.

Paul Mach

Navindra Yadav

Varun Sagar Malhotra

Shashi Gandham

Abhishek Ranjan Singh

Shih-Chun Chang

Ali Parandehgheibi

Rohit Chandra Prasad

Hoang Viet Nguyen

Sunil Gupta

Michael Standish Watts

Ravi Prasad

Rachita Agasthy

Omid Madani

Weifei Zeng

Gabriel J Fontenot

Yash Vipul Doshi

Sayeed Mohammed Tasnim

Shashidhar R Gandham

Thanh Trung Ngo

Thanh Nhan Nguyen

Furong Ma Gisiger

Troy Michael Traina

Jana Radhakrishnan

Tony Lee

Edwin Gonzalez Urzua

Jorge Quintero

Amandeep Singh

Brijeshkumar Ravindrakumar Shah

Apurva Chhajed

Thanh Nhan Thi Nguyen

Sai Ankith Averineni

Sasidhar Evuru

Sameer Salim Mahomed Ali Ladiwala

Chakradhar Reddy Vangeti

Maxwell Aaron Mechanic

Leo Romanovsky

Devices, systems, methods, and processes for automatically generating, at least in part, a segmentation strategy. Users of workload protection solutions can initiate a process to deploy various agents onto a network with one or more operating systems. The initial scope may be defined via one or more best practices to generate a scope tree. Associated labels may be defined based on the scope design and any subnets learned from the installed agent interface subnets. Common services can also be defined based on well known ports and/or protocols. Agent-based host names can also be evaluated to define potential application groupings. A generated application dependency mapping can be applied to understand potential application boundaries and potential policy recommendations. These steps can help a user to begin their segmentation strategy when deploying a workload protection solution.

Zero touch policy provisioning in workload protection solutions

Devices, systems, methods, and processes for determining enforcement readiness in a workload protection solution are described herein. Often, a user may desire to initiate enforcement on a network, but may not know if the various workloads, agents, or other components of the workload protection solution are in a condition to begin enforcement. As a result, embodiments described herein can generate an enforcement validation status or overall enforcement readiness determination by evaluating a plurality of different configurations, attributes, or other settings associated with any desired workloads subject to the policy to be enforced. Upon evaluation, a notification can be generated to the user in the form of a graphical user interface or other similar output device that is configured to show any determined error or issue preventing enforcement readiness. As a result, these can be addressed by a user until enforcement can be activated, easing the overall enforcement process.

Systems and methods for enforcement readiness verification

This disclosure provides solutions for automatically grouping network devices (e.g., endpoints) into clusters based on device characteristics. In some aspects, the disclosed technology also provides solutions for generating user selectable queries based on cluster characteristics. A process of the disclosed technology can include steps for identifying one or more device characteristics associated with a first network device, identifying one or more cluster characteristics for each of a first cluster and a second cluster, and comparing the device characteristics associated with the first network device with the one or more cluster characteristics for the first cluster and the second cluster. The process can further include steps for adding the first network device to the first cluster based on the cluster characteristics for the first cluster and the device characteristics for the first network device. Systems and machine-readable media are also provided.

Endpoint cluster assignment and query generation

The disclosed technology relates to intent driven network management. A system is configured to maintain an inventory store comprising records for a set of network entities in a network, wherein each network entity in the set of network entities is associated with a record in the inventory store. The system receives a user intent statement comprising an action and a flow filter representing network data flows on which the action is to be applied and queries, based on the flow filter, the inventory store to identify a plurality of network entities in the set of network entities to which the user intent statement applies. The system generates a plurality of network policies that implement the user intent statement based on the plurality of network entities and the action and enforces the plurality network policies.

Intent driven network policy platform

The present disclosure relates to methods, systems, and non-transitory computer readable media for discovering policy scopes within an enterprise network and managing network policies for discovered policy scopes. In one aspect, a method includes identifying one or more communities of devices in an enterprise network; defining, from the one or more communities of devices, policy scopes in the enterprise network; generating a hierarchical representation of the policy scopes; identifying, based on the hierarchical representation of the policy scopes, one or more policies governing traffic flow between devices associated with each of the policy scopes; and managing application of the one or more policies at the devices.

Scope discovery and policy generation in an enterprise network

Determining top venues from aggregated user activity location data is disclosed, including: receiving a set of location data associated with user activities; determining a plurality of stop events using the set of location data associated with the user activities; and selecting a plurality of top venues based at least in part on the plurality of stop events. Furthermore, top venues associated with user activities can be used to detect group activities and/or tour activities.

Determining top venues from aggregated user activity location data

One embodiment of an invention which computes a location based alignment of two tracks over a set route. Once aligned, a comparison of performance statistics is made at each position along the track. Time and distance gap information is also computed at each position. The results are then displayed in a plot () so one can see where different performance statistics changed, including time gap information (). The data is also linked to a map () so one can visualize the locations more clearly. It is also possible to compare multiple tracks () to one reference track () for greater insight.

Method and system for comparing performance statistics with respect to location

Growing community of inventors

Oakland, CA, United States of America

Paul Mach