Abstract: Techniques are disclosed for facilitating analysis of cloud activity. A cloud activity analysis agent may run within a virtual machine in a cloud computing environment to collecting information regarding computing activity within the virtual machine. The cloud activity analysis agent may include, in network flow data records, cloud activity data based on the collected information. The cloud activity analysis agent may then transmit the network flow data records to a network device for flow analysis. In some embodiments, the network flow data records are transmitted to a network flow analyzer that is configured to receive the cloud activity data and is further configured to receive network flow data from one or more flow collectors within a network of the entity. The network flow analyzer may then perform a security analysis for the entity based on the network flow data and the cloud activity data.

Abstract: Techniques are disclosed for supplementing network flow analysis with data collected from endpoint computer systems in a network. An endpoint analysis agent may run on endpoints to collect information relating to computing activity internal to the endpoint, including system configuration information, event information, and network, user, process, and file activity. This information may be reported to a network flow analyzer using an extensible flow data record format. The flow analyzer may then correlate this information with network flow data records received from flow collectors in the network to perform a security analysis. In various embodiments, the endpoint analysis agent may cache the collected information when the endpoint is offline. The agent may also perform data reduction operations (such as compression) on the collected information before reporting; data may be further reduced by reporting data only during specified time periods. An analysis agent may also be deployed in a cloud environment.

Abstract: Techniques are disclosed relating to improving resource usage on a computer system. In one embodiment, a computer system identifies a plurality of processes running on the computer system and determines an importance value and a resource consumption value. In such an embodiment, the importance value is indicative of an importance of an identified process, and the resource consumption value is indicative of a resource consumption of the identified process. The computer system evaluates the importance value and the resource consumption value relative to a usage policy, and takes a corrective action with respect to the identified process based on the evaluating to reconcile resource consumption with process importance value.

Abstract: Techniques are disclosed relating to improving resource usage on a computer system. In one embodiment, a computer system identifies a plurality of processes running on the computer system and determines an importance value and a resource consumption value. In such an embodiment, the importance value is indicative of an importance of an identified process, and the resource consumption value is indicative of a resource consumption of the identified process. The computer system evaluates the importance value and the resource consumption value relative to a usage policy, and takes a corrective action with respect to the identified process based on the evaluating to reconcile resource consumption with process importance value.