Abstract: Overlay networks of application components are managed. Applicant components may create overlay networks based on policies of the application components and an environment of the overlay network. The overlay network may be adjusted based on changes to the policies or the environment.

Abstract: Examples herein involve managing overlay networks of application components. In examples herein, application components may create overlay networks based on policies of the application components and an environment of the overlay network. The overlay network may be adjusted based on changes to the policies or the environment.

Abstract: Examples relate to distributed anomaly management. In one example, a computing device may: receive real-time anomaly data for a first set of client devices, wherein the received anomaly data includes: anomalous network behavior data received from a network intrusion detection system (NICKS) monitoring network traffic behavior, anomalous host event data received from a host intrusion detection system (HIDS) monitoring host events originating from client devices in the first set, and anomalous process activity data received from a trace intrusion detection system (TIDS) monitoring process activity performed by client devices in the first set; for each client device in the first set of client devices for which anomaly data is received, associate the received anomaly data with the client device; and determine, for a particular client device, a measure of risk, wherein the measure of risk is dynamically adjusted based on the received real-time anomaly data.