Abstract: A method of remediating configurations of a plurality of system services running in each of a plurality of hosts, wherein each of the hosts is configured with a virtualization software for supporting execution of virtual machines therein, includes the steps of: retrieving actual configurations of the system services, wherein the actual configurations are stored in accordance with a configuration schema of the system services and include a user configuration, which is a configuration initiated by the user, and a system configuration, which is a configuration initiated by the host in response to the user configuration; retrieving desired configurations of the system services from a desired configuration file; comparing each of the actual configurations with a corresponding one of the desired configurations; and upon determining that at least one actual configuration, which is not a system configuration, is different from a corresponding one of the desired configurations, replacing the at least one actual config

Abstract: The disclosure provides an approach for decentralizing control plane operations in a network environment that includes transport nodes configured to implement a logical overlay network. A method includes transmitting a global list of transport nodes to each of the plurality of transport nodes from a management plane, the global list including an ordered list of the plurality of transport nodes. The method also includes transmitting a neighbor index value to each of the plurality of transport nodes, where the transport nodes each compute a corresponding list of neighbor transport nodes based on the neighbor index value and the global list of transport nodes. The method also includes, based on determining an update to a state of the logical overlay network has occurred by a first transport node, transmitting an update message from the first transport node to each transport node in the first transport node's list of neighbor transport nodes.

Abstract: Systems and methods are described for intelligent software patch management. In an example, a system can receive a selection of device attributes. The system can associate a group of computing devices with attribute values that correspond to each device. The system can also create value pairs of unique pairs of values for each computing device. The system can select a set of computing devices for a deployment ring that maximizes diversity of the values or value pairs. The system can deploy the software patch to the selected devices and monitor device performance for a predetermined period of time before continuing to the next deployment ring or rolling back the update.

Abstract: Described are systems and methods for automatically generating, by a computing device, a regular expression that matches a list of input strings. A method includes identifying a set of baseline regular expression classes that match a portion of an input string of the list of input strings. The method further generates a current regular expression as a sequence of baseline regular expression classes from the set of baseline regular expression classes based on matching baseline regular expression classes to characters of a first input string of the list of input strings. The method further determines whether the current regular expression matches all input strings of the list of input strings, and if it does not, the method regenerates a portion of the current regular expression that occurs after an earliest character, in order, of one of the one or more input strings, that does not match the current regular expression.

Abstract: The disclosure provides an approach for cross-network communication by self-replicating applications. Embodiments include identifying, by a first instance of a self-replicating application on a first computing device having a first network connection to a parent component, a second computing device that is connected to the first computing device via a second network connection. Embodiments include self-replicating, by the first instance of the self-replicating application, across the second network connection to produce a second instance of the self-replicating application on the second computing device. Embodiments include initiating, by the first instance of the self-replicating application, a proxy tunnel on the first computing device. Embodiments include receiving, by the proxy tunnel, a first communication from the second instance of the self-replicating application via the second network connection.

Abstract: Some embodiments configure an edge forwarding element to perform service insertion operations to identify stateful services to perform for data messages received for forwarding by the edge forwarding element at multiple virtual interfaces of the edge forwarding element. The service insertion operation, in some embodiments, includes applying a set of service insertion rules. The service insertion rules (1) specify a set of criteria and a corresponding action to take for data messages matching the criteria and (2) are associated with a set of interfaces to which the service insertion rules are applied. In some embodiments, the action is specified using a universally unique identifier (UUID) that is then used as a matching criteria for a subsequent policy lookup that identifies a type of service insertion and a set of next hop data.

Abstract: Example methods and computer systems for packet handling for active-active stateful service insertion are disclosed. One example may involve a computer system detecting a packet addressed from a source address to a service endpoint address. Based on configuration information associated with the service endpoint address, the computer system may identify a first active logical service router (SR) and a second active logical SR that are both associated with the service endpoint address and configured to operate in an active-active mode. The first active logical SR may be selected over the second active logical SR by mapping tuple information to the first active logical SR. The computer system may generate an encapsulated packet by encapsulating the packet with an outer header addressed to an outer destination address associated with the first active logical SR and send the encapsulated packet towards the first active logical SR for processing according to a stateful service.

Abstract: Methods and systems are directed to discovering problem incidents in a distributed computing system. Events corresponding to historical problems incidents for the distributed computing system are retrieved from a data base. Sets of representative events of the various historical problem incidents for the distributed computing system are determined. A runtime problem incident in the distributed computing system is characterized by runtime events. The runtime problem incident is classified as corresponding to a historical problem incident of the historical problem incidents based on the runtime events and the sets of representative events. Remedial measures used to correct the historical problem incident may be used to correct the runtime problem.

Abstract: Described herein are example methods and systems for enrolling a user device with an unified endpoint management system (“UEMS”) directly from another user device. The examples describe a first user device that is already enrolled with the UEMS and a second user device that is seeking to be enrolled. The two user devices can establish a direct connection with each other. The second user device can be authenticated by a user inputting the same migration password or pin at both user device. The first user device can generate and send a migration data file to the second user device. The migration data file can include settings, policies, software packages, and files managed by the UEMS. The second user device can copy settings, policies, and files, and install the applications from the migration data file. The second user device can notify an UEMS server of the device migration.

Abstract: Systems and methods are described for onboarding a new device to a blockchain secured network. A trusted device that is already enrolled on the blockchain can receive information from a new device. The new device can send an onboarding request to a server through a non-blockchain secured Application Programming Interface (“API”). The trusted device can send an onboarding request for the new device through a blockchain secured API. The server can receive the requests and match them. The server can authenticate the two devices and send a request to a blockchain consensus to add the new device to the blockchain with the trusted device as a referral. The blockchain consensus can add the new device to the blockchain and notify the server. The server can notify the new device, and the new device can begin communicating through the blockchain secured API or directly with other devices on the blockchain.

Abstract: Some embodiments of the invention provide a novel method of performing network slice-based operations on a data message at a hardware forwarding element (HFE) in a network. For a received data message flow, the method has the HFE identify a network slice associated with the received data message flow. This network slice in some embodiments is associated with a set of operations to be performed on the data message by several network elements, including one or more machines executing on one or more computers in the network. Once the network slice is identified, the method has the HFE process the data message flow based on a rule that applies to data messages associated with the identified slice.

Abstract: Examples described herein include systems and methods for improved application rollback or application migration on a user device. A portal application can store state information for multiple applications installed on a user device. The portal application can send the state information to a management server that exerts management control over aspects of the user device. The management server can send a rollback command to the portal application, instructing the portal application to rollback a target application that is already installed on the device. The portal application can cause the application to be uninstalled and can install a new instance of the target application as specified by the rollback command. The example method can further include the portal application providing at least some state information to the new instance of the application. The new instance of the application can use that state information to implement a configuration in the application.

Abstract: Examples described herein include systems and methods for providing user-specific previews for terms within text. An example method can include receiving tracked user behavior reflecting terms selected by a user and entered into a search. A representation of known words can be created based on the tracked user behavior. By training machine-learning models for each individual user, personalized previews can be presented when each user encounters a new body of text, such as in a webpage or email. The preview can apply to a term not previously known to the user but likely to be searched by the user, relying on content gathered from a search on a search medium that the user was likely to use. The content can be presented to the user in a graphical user interface allowing for interaction and feedback.

Abstract: Examples described herein include systems and methods for providing network insights on a graphical user interface (“GUI”). The GUI can visualize network errors to help administrative or information technology users more quickly identify issues with an enterprise application. The enterprise application can report network request information to a server. Then the GUI can present visual overlays that compare error metrics between different time cycles of the application. The visual overlay can graphically display these errors on top of one another for immediate relative visualization. Additionally, a grouped list of host destinations can be simultaneously provided. The destination addresses can be abbreviated, and errors grouped accordingly in a manner that provides advantageous error visualization.

Abstract: Techniques for dynamically generating user interface (UI) components based on hierarchical component factories are disclosed. In one example, a component factory corresponding to each of a plurality of UI components may be defined. The plurality of UI components associated with an application may be registered with a common registry using associated metadata and configuration information. Each UI component may be mapped to a component factory of an associated parent UI component based on the associated metadata. A request to render at least a portion of the application on a UI may be received. At least one UI component corresponding to the request at each level in a hierarchy may be generated, at runtime, using the component factory associated with the at least one UI component and the common registry. The at least one generated UI component may be rendered on the UI.

Abstract: Some embodiments provide a novel method for adjusting a path for a packet flow from a source machine to a destination machine in a network. The method of some embodiments identifies a condition at a first forwarding element along a first path traversed by the packet flow through the network. The first path traverses through a hardware, second forwarding element before the first forwarding element. In some embodiments, the second forwarding element includes a programmable data plane circuit. The method, in some embodiments, uses an application programming interface (API) of the programmable data plane circuit to provide a set of parameters to the data plane circuit that cause the data plane circuit to forego selecting the first path to forward the packets of the packet flow to the destination machine and instead to select a second path, not traversing the first forwarding element, to the destination machine.

Abstract: A system and method for performing firewall operations on an edge service gateway virtual machine that monitors traffic for a network. The method includes detecting, from a directory service executing on a computing device, a login event on the computing device, obtaining, from the detected login event, login event information comprising an identifier that identifies a user associated with the login event, storing the login event information as one or more context attributes in an attribute table, and applying a firewall rule to a data message that corresponds to the one or more context attributes.

Abstract: Example methods for a network device to perform address resolution handling. The method may comprise: in response to a first distributed router (DR) port of a first DR instance detecting an address resolution request from a second DR port of a second DR instance, generating a modified address resolution request that is addressed from a first address associated with the first DR port instead of a second address associated with the second DR port. The modified address resolution request may be broadcasted within a logical network that is connected to the first DR instance through network extension. The method may also comprise: in response to detecting an address resolution response that includes protocol-to-hardware address mapping information associated with an endpoint located on the logical network, generating and sending a modified address resolution response towards the second DR port of the second DR instance.

Abstract: Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to generate virtual resource provisioning visualizations. An example apparatus includes a visualization generator to generate a visualization based on a comparison of first provisioning requirements from a blueprint to parameters associated with the cloud computing environment, the first provisioning requirements associated with the provisioning of the virtual resource to the cloud computing environment, a blueprint controller to adjust one or more of the first provisioning requirements to one or more second provisioning requirements in response to determining that the first provisioning requirements are not satisfied based on the visualization, and a deployment controller to deploy the virtual resource to the cloud computing environment based on the one or more second provisioning requirements.