Abstract: Embodiments relate systems and methods for detecting network conditions based on derivatives of event trending. In embodiments, a network management server can monitor the status and operation of network machines, such as servers or targets, as well as network transmission hardware (e.g. routers). Streams of network operation data from those sources can be captured and stored. The management server or other logic can examine the network operation data to identify trend lines for network conditions, such as application faults, attempted intrusions, or other events or conditions. trend line data can be treated to generate second or other higher-order derivatives, such as third-order derivatives representing the rate of change of acceleration (or jerk) in the time series of one or more conditions. The presence of acceleration or jerk for one or more trend lines, such as attempted network intrusions, can reflect an event and trigger a flag or other automated response.

Abstract: Embodiments relate systems and methods for detecting network conditions based on a correlation between trend lines. In embodiments, a network management server can monitor the status and operation of network machines, such as servers or targets, as well as network transmission hardware (e.g. routers). Streams of network operation data from those sources can be captured and stored. The management server or other logic can examine the network operation data to identify trend lines for network conditions, such as application faults, attempted intrusions, or other events or conditions. Trend line data can be treated to generate second or other higher-order derivatives, such as third-order derivatives or others. A time correlation between two or more trend lines and/or their higher order derivatives, for instance, the occurrence of a peak value in the same time window, can be used to identify an event, state or condition.

Abstract: Embodiments relate to systems and methods for generating a reverse installation file for network restoration. A set of managed machines, such as personal computers or servers, can be managed by a network management engine communicating with the machines via a secure channel. The network management engine can scan the managed network for kickstart, or provisioning answer files, that were used to install software to network nodes at a prior time. The network management engine can access the original kickstart file, and update that file to reflect a current state of the associated machine by inserting user-supplied updates, storage configuration updates, security credentials, and/or other data. Upon a crash or other malfunction of the associated machine, the network management platform can access the reverse kickstart file and generate a restoration of that node to a current state from the reverse kickstart data.

Abstract: An administrator system can utilize a history generated by a tagging tool to determine the current configuration of computing systems. The administrator system can utilize the current configuration to verify that the computing systems have been configured properly and verify, over time, that the computing systems maintain the desired configuration. The administrator system can compare the current configuration with the desired configuration for the computing systems.

Abstract: Embodiments relate to systems and methods for depopulation of user data from a network. A network management platform can communicate with a set of managed machines in a network, and generally manage user accounts including user IDs, associated network processes, services, application files, data files, and/or other user data. In embodiments, a user may have a change in status, such as departing from the organization operating the network, changing their name or user name, or other updates. In such cases, a systems administrator may need to update or delete files, processes, services, and/or other user data associated with the user from the network. The network management platform can interrogate the network for files, processes, or other resources associated with the user ID of interest. The search can exhaustively interrogate every available node in the network, to update or purge all files associated with the subject user ID(s).

Abstract: Embodiments relate to systems and methods for network management using a secure mesh command and control framework. A network management server can communicate with a set of supervisory hosts, which in turn communicate with an underlying set of targets. The set of targets can have associated digital certificates which can be authenticated by common certificate authorities. A controlled target can authenticate one or more other target requesting access to the controlled target via the trusted common certificate authority. One authenticated target can therefore mesh on a trusted basis with another target to perform installation, monitoring, testing, or other activities directly on the target of interest, without channeling commands through an intervening supervisory host.

Abstract: Embodiments relate to systems and methods for automatic discovery of network software relationships. A set of managed machines, such as personal computers or servers, can be managed by a network management platform communicating with the machines via a secure channel. The network management platform can issue a set of discovery commands interrogating nodes of the network to report software or services which they consume. The network management platform can build a dependency map encoding the dependency or other relationships between nodes in the managed network based on their use of software resources. Network restorations can therefore be conducted in a rational order, maintaining stability in the restored nodes and network.

Abstract: A provisioning server can provide and interact with a firmware tool on target machines. The firmware tool can communicate with the firmware of the target machines and collect data representing the configuration of the firmware of the target machines, independent of the types of the target machines. To communicate independent of the type of target machine, the firmware tool can include a translation library. The translation library enables the firmware tool to receive common instructions for interacting with firmware and convert those common instructions into specific instructions that are compatible with different types of the target machines.

Abstract: A provisioning server can remotely deliver a rescue environment to a malfunctioning target machine. The provisioning server can operate in conjunction with a network management server in order to identify malfunctioning target machines, for example, target machines with damaged operating systems. Once a malfunctioning target machine is identified, the provisioning server can be configured to identify a rescue environment to repair the malfunctioning target machine and provide the rescue environment to the malfunctioning target machine.

Abstract: A provisioning server can provide and utilize a diagnostic tool to test and interrogate hardware on target machines and to collect data from the hardware. The diagnostic tool can operate on the target machine independently of software already installed on the target machine. The diagnostic tool can interrogate hardware of the target machine and collect data from the hardware of the target machine. The provisioning server can select the diagnostic tool from a set of pre-generated diagnostic tools or generate a custom diagnostic tool tailored to a specific target machine. The provisioning server can interact directly with the diagnostic tool or interact with the diagnostic tool utilizing a network management server. Once data is collected, the provisioning server can be configured to store the collected data and/or output the data to other parties or systems.

Abstract: A provisioning server can remotely determine target machines, requiring a hardware update, and remotely provide the hardware updates to the target machines. The provisioning server can identify hardware updates for target machines in a network it serves. The provisioning server can operate in conjunction with a network management server in order to identify the target machines, requiring the hardware update. The provisioning server can generate the hardware update for the target machines and provide the hardware update to the target machines.

Abstract: A network management server can be configured to search the components of computing systems and devices in a managed network for specified settings and configurations in order to determine if the computing systems or devices contain the specified settings and configurations. The network management server can receive a request containing search parameters. The search parameters can identify specific settings and configurations to search for in the components of the systems and devices of the managed network. The network management server can initiate a search of the components of all the systems and devices in the managed network based on the search parameters.

Abstract: An embodiment relates generally to a method of distributing virtual machines. The method includes specifying a set of requirements for a virtual machine and instantiating a virtual machine based on a lightweight reusable profile, based on the set of requirements as described in the profile. The method also includes importing the profile to a distribution server; and distributing the profile to at least one physical machine in response to a request. Software can be added to the at least one physical machine that can manage the deployment of the physical hosts as a farm to hosting the virtual images.

Abstract: Embodiments relate to systems and methods for automatically generating a system restoration order for network recovery. A set of managed machines, such as personal computers or servers, can be managed by a network management platform communicating with the machines via a secure channel. The network management platform can access a dependency map indicating a required order for restoration of machines or nodes on a network. The network management platform likewise access a reverse kickstart file for each machine to be automatically restored in order to ensure proper functioning of the network, and extract a current configuration of that machine for purposes of restoring the overall network.

Abstract: Embodiments relate systems and methods for detecting machine faults in a network using acoustic monitoring. In embodiments, one or more servers, clients, or other machines in a managed network can have a microphone or other acoustic sensor integrated into motherboard or other hardware. The sensor can sample acoustic signals from inside or near the machine, and can digitize that data. The resulting set of acoustic data can be transmitted to a management server or other destination for analysis of the operating sounds related to that machine. For instance, the acoustic data can be analyzed to detect indications of a failed or failing hard drive, for instance by detecting spindle whine or head movement noises, or a failed or failing power supply based on other sounds. The management server can respond to potential fault events for instance by issuing configuration commands, such as instructions to power down the malfunctioning component.

Abstract: A security tool can access a tagging tool and the history generated by the tagging tool in order to identify potential threats and analyze the identified threats. When a potential threat is detected or an actual threat is identified, the security tool can request the history of actions from the tagging tool corresponding to the threat. The security tool can compare the potential or actual threat with the history of any action recorded by the tagging tool in order to classify a potential threat as an actual threat or determine the source or cause of an actual threat.

Abstract: In order to track actions performed by a package manager, a computing system can be configured to include a tagging tool. The tagging tool can be configured to cooperate with the package manager in order to determine and generate a history of the actions performed by the package manager. The history can include a description of the actions, the reasons why the actions were performed, and a list and description of the software programs, files, and software libraries that are affected by the actions.

Abstract: A software provisioning server can be configured to communicate with a certificate authority to evaluate security credential requests received from one or more target machines prior to a software installation. The certificate authority can issue certificates to the one or more target machines and notify an administrator and the software provisioning server of the issued certificates. The software provisioning server can manage the software installation to the one or more target machines based on the issued certificates and other specifications.

Abstract: A provisioning server can utilize an inventory tool on new target machines in order to collect specification data from the target machines, prior to provisioning software. The inventory tool can be configured to operate on the new target machines without software, such as an operating system, being installed on the new target machines. The inventory tool can be configured to communicate with the hardware of the new target machines and collect data representing the specifications of the new target machines. The inventory tool can be configured to operate and execute on any new target machine regardless of the type and configuration of the new target machine.

Abstract: Embodiments relate to systems and methods for secure distributed storage. In aspects, a set of remote storage hosts, such as personal computers, servers, media devices, cell phones, or others, can subscribe or register to provide storage via a cloud-based or other distributed network. Source data from an originating computer, such as a data file, can be decomposed into data storage subunits, each of which is encrypted via a cloud management system or other logic or control. The data storage subunits can comprise data blocks or even or uneven size. The set of encrypted data storage subunits can be registered to a table or other record, and disseminated to the remote storage hosts. In the event of data loss at the originating computer or at other times, the remotely stored data storage subunits can be extracted, decrypted, and reassembled to reconstruct the original source data.