Abstract: Systems and methods for monitoring network activity. The methods include receiving at an interface a first logging parameter for a first network device, wherein the first logging parameter specifies how the first network device is to record data associated with the first network device; communicating the first logging parameter to the first network device; and indicating to the first network device a first network-accessible location to where the first network device is to transmit its recorded data, wherein the first network device is configured to record data in accord with the first logging parameter and transmit the recorded data to the first network-accessible location.

Abstract: An endpoint device uses hardware-based security to authenticate to an enterprise network. For example, an endpoint device such as network hardware or an end user device can request authentication in order to join an enterprise network that is managed by a computing platform such as a threat management facility. In one aspect, an authenticator at the computing platform sends a challenge payload in response to the request from the endpoint device. The endpoint device may then sign the challenge payload with a hardware-based security system that was bound to the endpoint device at manufacture, and return a response to the authenticator that includes the signed challenge payload. The authenticator can cryptographically validate the response and generate an authentication token for use by the endpoint device when joining the enterprise network.

Abstract: A policy created through an administrative user interface is converted into an intermediate representation that can be compiled for execution by a gateway or converted into a human-readable form for modifications by the administrator.