Cisco Technology, Inc.

Sunil Gupta

Navindra Yadav

Shashidhar R Gandham

Ali Parandehgheibi

Michael Standish Watts

Ashutosh Kulshreshtha

Khawar Deen

Hoang Viet Nguyen

Rohit Chandra Prasad

Varun Sagar Malhotra

Shashi Gandham

Shih-Chun Chang

Anubhav Gupta

Abhishek Ranjan Singh

Supreeth Hosur Nagesh Rao

Hai Trong Vu

Jackson Ngoc Ki Pang

Praneeth Vallem

Ravi Prasad

Omid Madani

Vimalkumar Jeyakumar

Ellen Christine Scheib

Roberto Fernando Spadaro

Bharathwaj Sankara Viswanathan

Fnu Rachita Agasthy

Duane Thomas Barlow

Darshan Shrinath Purandare

Supreeth Rao

Jothi Prakash Prabakaran

Janardhanan Radhakrishnan

Xuan Zou

Umesh Paul Mahindra

Hoang-Nam Nguyen

Paul Mach

Rachita Agasthy

Joseph Daniel Beshay

Xin Yi Liu

Paul John Lesiak

Thanh Trung Ngo

Xuan Loc Bui

Akshay Srirangam

Varun Sagar Malhorta

Girish Anant Kalele

Tamir Peres

Suraj Pandya

Vanessa Layson

Bruce Dressel

Matthew Gavin

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

This disclosure generally relate to a method and system for network policy simulation in a distributed computing system. The present technology relates techniques that enable simulation of a new network policy with regard to its effects on the network data flow. By enabling a simulation data flow that is parallel and independent from the regular data flow, the present technology can provide optimized network security management with improved efficiency.

System and method for network policy simulation

A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

System and method of assigning reputation scores to hosts

An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

Policy utilization analysis

Aspects of the subject technology relate to a system configured to receive a set of network snapshot segments from an output stream of a stream processing service, compile the set of network snapshot segments from the set of messages into a first network snapshot and a second network snapshot, and compare the first network snapshot and the second network snapshot to identify a difference between the first network snapshot and the second network snapshot.

Mechanism for identifying differences between network snapshots

An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.

Application monitoring prioritization

The disclosed technology relates to intent driven network management. A system is configured to maintain an inventory store comprising records for a set of network entities in a network, wherein each network entity in the set of network entities is associated with a record in the inventory store. The system receives a user intent statement comprising an action and a flow filter representing network data flows on which the action is to be applied and queries, based on the flow filter, the inventory store to identify a plurality of network entities in the set of network entities to which the user intent statement applies. The system generates a plurality of network policies that implement the user intent statement based on the plurality of network entities and the action and enforces the plurality network policies.

Intent driven network policy platform

Systems, methods, and computer-readable for defining host functionalities in a computing environment include obtaining two or more snapshots comprising information pertaining to two or more processes executing in two or more hosts, the two or more snapshots being obtained at two or more points in time from the two or more hosts. One or more long-running processes amongst the two or more processes are identified based on one or more criteria associated with long-running processes. One or more priorities associated with the one or more long-running processes and used for defining functionalities for at least a subset of the two or more hosts, where high priorities are assigned to long-running processes, such as web server or database server processes, which are unique to at least the subset of the two or more hosts. Resources may be provisioned based on these host functionalities.

Provisioning resources for monitoring hosts based on defined functionalities of hosts

The disclosed technology relates to a network agent for generating platform specific network policies. A network agent is configured to receive a platform independent network policy from a network policy system, determine implementation characteristics of the network entity, generate platform specific policies from the platform independent network policy based on the implementation characteristics of the network entity, and implement the platform specific policies on the network entity.

Network agent for generating platform specific network policies

Growing community of inventors

Milpitas, CA, United States of America

Sunil Gupta