Abstract: Techniques for implementing intelligent querying of network-connected devices are disclosed. In some embodiments, a method comprises the following: identifying a set of unique identifiers corresponding to a set of devices connected to a network; obtaining information associated with a set of communications transmitted to or from a particular device in the set of devices based on the unique identifier corresponding to the particular device; identifying a device type for the unique identifier corresponding to the particular device based on the identified information associated with the set of communications; selecting a subset of a candidate set of queries based on the identified device type for the unique identifier; and executing the subset of the candidate set of queries on the particular device based on the selecting of the subset.

Abstract: Techniques for implementing a natural language query interface that enables interaction with a computer system through natural language inputs are disclosed. In some embodiments, a method comprises the following: receiving a first user input comprising a first natural language prompt; generating a first instruction for a Large Language Model (LLM) to determine a first user intent category of the first natural language prompt; submitting the first instruction to the LLM, wherein the LLM determines the first user intent category based on the first natural language prompt; receiving the first user intent category from the LLM; mapping the first user intent category, received from the LLM, to a first particular process of a set of processes; and executing the first particular process in response to receiving the first user input.

Abstract: A system identifies a target device within a network and monitors interactions between a support device and the target device. Based on the monitored interactions, the system generates a support score for the support device, representing its contribution to the functionality of the target device. The system prioritizes a remediation action corresponding to the support device based at least in part on the support score for the support device.

Abstract: Techniques for implementing intelligent querying of network-connected devices are disclosed. In some embodiments, a method comprises the following: identifying a set of unique identifiers corresponding to a set of devices connected to a network; obtaining information associated with a set of communications transmitted to or from a particular device in the set of devices based on the unique identifier corresponding to the particular device; identifying a device type for the unique identifier corresponding to the particular device based on the identified information associated with the set of communications; selecting a subset of a candidate set of queries based on the identified device type for the unique identifier; and executing the subset of the candidate set of queries on the particular device based on the selecting of the subset.

Abstract: Techniques for integrating one or more dataset schemas with a natural language prompt to generate a query for obtaining results to the natural language prompt are disclosed. In some embodiments, a method comprises the following: receiving user input comprising a natural language prompt; generating an instruction for a Large Language Model (LLM) to generate a query, wherein the instruction specifies the natural language prompt and a first subset of dataset schemas; submitting the instruction to the LLM, wherein the LLM generates the query based on the instruction; receiving the query from the LLM, wherein the query is based on and directed to the first subset of dataset schemas; executing the query on the data repository to generate a set of one or more results based on the first subset of dataset schemas; and storing the set of one or more results in response to the natural language prompt.

Abstract: A system generates a graph of assets in a network. The system defines connections between assets within the graph. The system identifies a risk event with an associated risk severity. The system determines a number of connections to traverse for generating a risk analysis pathway through the graph of assets in the network based on the associated risk severity associated with the risk event. The system generates a recommendation to address the identified risk.

Abstract: Techniques for filter and sort versions of software instances executing on computing devices in a network are disclosed. The system receives an instruction to execute an operation on software instances that satisfy numerical criterion and non-numerical criterion. A standardizing function is applied to the numerical criterion to determine a standardized numerical criterion. The system accesses version number values corresponding to software instances on the computing devices in the network. By applying the standardizing function to numerical version numbers of the version number values, the system determines standardized numerical version numbers for the version number values. The system filters the standardized numerical version numbers based on the standardized numerical criterion. The system identifies software instances with (a) associated standardized numerical version numbers that meet the standardized numerical criterion and (b) non-numerical components that meet the non-numerical criterion.

Abstract: Techniques for determining operations for transmitting information from a device on a network are disclosed. Using information identifying a device type and a version of the script executing on the device, the system computes a first dynamic manifest for the device that provides a set of operations for execution in relation to the device. This may include checking the version of the script executing on the device. The system provides an up-to-date version of the script to the device and instructs the device to update the script. The device receives and stores the updated version of the script and initiates a script restart. Upon restarting the script, the device executes the updated version of the script. The system then computes a second dynamic manifest for the device that provides another set of operations for execution in relation to the device.

Abstract: Techniques for determining whether a device communicating in a network should transmit a payload, e.g., priority dataset, to a server based on the device type, analysis of the current attributes of the device, and the location of the device are disclosed. When the current attributes of the device, in combination with the device location, are determined to meet criticality criteria, instructions are provided to the device to refrain from transmitting the payload. When the current attributes of the device, in combination with the device location, are determined to not meet criticality criteria, instructions are provided to the device to permit transmission of the payload by the device.

Abstract: Machine learning techniques are described for analyzing information network traffic to identify different devices connected to a network. Transmitted network packets may be passively collected and analyzed. In some cases the described techniques may be used to identify distinct devices connected to a network even though the collected and analyzed packets may lack a unique device identifier, such as a media access control (MAC) identifier, corresponding to a device that originated the packets.

Abstract: Techniques are disclosed for generating a combined visual representation of subsets of devices associated with corresponding sub-networks of a private network, where at least two devices in corresponding sub-networks share a same private internet protocol (IP) address. The system generates a separate profile for each device using a combination of elements including at least (a) a private IP address corresponding to the device and (b) a network identifier corresponding to a sub-network associated with the device. These sub-networks and their constituent devices may be visually represented in corresponding user interface elements.

Abstract: Presenting, at a graphical user interface (GUI), device photos and risk categories associated with devices in a network is described. Data packets communicated in a network are detected. Based on the detected data packets, a set of devices in the network are determined. A set of device photos associated respectively with the set of devices are determined. A GUI concurrently presents the set of device photos to indicate the set of devices detected in the network. The set of devices may be filtered, sorted, and/or grouped based on various criteria. The GUI may present the device photos according to the filtering, sorting, and/or grouping. Additionally or alternatively, risk scores associated respectively with the set of devices are determined. The set of devices are categorized into respective risk categories based on the associated risk scores. A GUI concurrently presents a set of risk categories and information associated with each risk category.

Abstract: Techniques for identifying and mapping applications to devices in a network are disclosed. A system monitors data transmitted on a network to identify a plurality of data traffic patterns in the network. Based on the plurality of data traffic patterns, the system identifies a plurality of applications associated with respective subsets of the data, the plurality of applications including a first and a second application. The system determines that a particular network infrastructure element, among the plurality of network infrastructure elements, processes data associated with the first application. The system stores a mapping between the particular network infrastructure element and the first application.

Abstract: Techniques are described for analyzing information network traffic to identify distinct devices connected to a network based on characteristics exhibited by the devices. Techniques may analyze some or all of network characteristics, device behavioral patterns, and/or device characteristics detected in network traffic. One or more of these characteristics, may be assigned to a profile associated with a device. This profile, by establishing one or more patterns of behavior and/or characteristics, may be used as a “fingerprint” to uniquely identify a device connected to a network even for devices that employ randomized identifiers, such as MAC addresses, that would otherwise obscure unique identification of the device. Profiles exhibiting similar patterns of behaviors and/or characteristics may be identified and merged to avoid duplicate identification of a same device.

Abstract: Techniques for identifying and mapping applications to devices in a network are disclosed. A system monitors data transmitted on a network to identify a plurality of data traffic patterns in the network. Based on the plurality of data traffic patterns, the system identifies a plurality of applications associated with respective subsets of the data, the plurality of applications including a first and a second application. The system determines that a particular network infrastructure element, among the plurality of network infrastructure elements, processes data associated with the first application. The system stores a mapping between the particular network infrastructure element and the first application.

Abstract: Techniques are disclosed for generating a combined visual representation of subsets of devices associated with corresponding sub-networks of a private network, where at least two devices in corresponding sub-networks share a same private internet protocol (IP) address. The system generates a separate profile for each device using a combination of elements including at least (a) a private IP address corresponding to the device and (b) a network identifier corresponding to a sub-network associated with the device. These sub-networks and their constituent devices may be visually represented in corresponding user interface elements.

Abstract: Techniques for generating and enforcing security policies for device clusters are disclosed. A security manager generates a plurality of clusters of devices for applying security policies. For each cluster of devices, the security manager trains a machine learning model to indicate whether a particular data flow associated with a device in the particular cluster of devices is allowed or denied. The security manager detects a data flow corresponding to a device. If the security manager determines that the device corresponds to a first cluster of devices, the security manager identifies a first trained machine learning model corresponding to the first cluster of devices. The security manager applies the first trained machine learning model to the first data flow to determine whether the first data flow is to be allowed or denied. The security manager allows or denies the first data flow based on the applying operation.

Abstract: Techniques are described for analyzing information network traffic to identify distinct devices connected to a network based on characteristics exhibited by the devices. Techniques may analyze some or all of network characteristics, device behavioral patterns, and/or device characteristics detected in network traffic. One or more of these characteristics, may be assigned to a profile associated with a device. This profile, by establishing one or more patterns of behavior and/or characteristics, may be used as a “fingerprint” to uniquely identify a device connected to a network even for devices that employ randomized identifiers, such as MAC addresses, that would otherwise obscure unique identification of the device. Profiles exhibiting similar patterns of behaviors and/or characteristics may be identified and merged to avoid duplicate identification of a same device.

Abstract: Machine learning techniques are described for analyzing information network traffic to identify different devices connected to a network. Transmitted network packets may be passively collected and analyzed. In some cases the described techniques may be used to identify distinct devices connected to a network even though the collected and analyzed packets may lack a unique device identifier, such as a media access control (MAC) identifier, corresponding to a device that originated the packets.

Abstract: Systems and methods described may deduce that a machine is in use for a period of time preceding and/or subsequent to a detected operation. The deduction of the usage period may be based on a type of the detected operation. The system may deduce that a machine is in-use during a period of time that spans from (a) a first point-in-time when a first type of operation was detected to (b) a second point-in-time when a second type of operation was detected.