Abstract: Each module of a plurality of modules receives intent metadata associated with a data product instance of a data mesh. Each module corresponds to a unique data governance category of a plurality of data governance categories and a request associated with data was intercepted at the data product instance. Each module receives policy metadata associated with the data governance category corresponding to the module. Each modules determines, based on the intent metadata and the policy metadata, whether the request is valid for the data governance category corresponding to the module. Each modules transmits an indication of whether the request is valid for the module.

Abstract: A server may receive, from a virtual private network (VPN) client of a client device, a message which indicates a request for a policy rule for communications with a network-based application (e.g. provided via a data center or cloud computing services). The server may obtain source attributes of the client device and a user thereof based on source identifiers, and destination attributes of the application based on a destination identifier, and select a policy rule associated with the attributes (e.g. indicative of security, risk, cost, load, and/or business function). The server may send a message which indicates a response and includes the policy rule for application at the VPN client. The policy rule may indicate a policy action for selecting a path, of a plurality of paths, identified by a path identifier, and specify conditions such as a location and/or a date, day, and/or time of the client device.

Abstract: A server may receive, from a virtual private network (VPN) client of a client device, a message which indicates a request for a policy rule for communications with a network-based application (e.g. provided via a data center or cloud computing services). The server may obtain source attributes of the client device and a user thereof based on source identifiers, and destination attributes of the application based on a destination identifier, and select a policy rule associated with the attributes (e.g. indicative of security, risk, cost, load, and/or business function). The server may send a message which indicates a response and includes the policy rule for application at the VPN client. The policy rule may indicate a policy action for selecting a path, of a plurality of paths, identified by a path identifier, and specify conditions such as a location and/or a date, day, and/or time of the client device.

Abstract: In one embodiment, a device receives sensor data from a plurality of sensors. The device detects, using a semantic reasoning engine, a disruption to a first shipment based on the sensor data. The device infers, using the semantic reasoning engine, that one or more other shipments are related to the first shipment. The device initiates a mitigation action for the disruption that is performed with respect to the one or more other shipments.

Abstract: In one embodiment, a device transmits data characterizing a holographic image to a physical environment. A visible rendering of the holographic image is created in the physical environment. The device uses a reasoning engine to make an inference regarding a state of the physical environment based on sensor data captured in the physical environment indicative of one or more real-time characteristics of the physical environment. In response to the inference, the device adjusts the holographic image. Then, the device transmits data characterizing the adjusted holographic image to the physical environment, and a visible rendering of the adjusted holographic image is created in the physical environment.

Abstract: According to one or more embodiments of the disclosure, a particular networking device located in a ring of networking devices of a network receives an indication from a supervisory service that the particular networking device has been designated a ring manager for the ring of networking devices. The particular networking device determines that the supervisory service is unreachable by the ring of networking devices. The particular networking device obtains telemetry data regarding a new device connected to the ring of networking devices. The particular networking device onboards, based on the telemetry data, the new device to the network, when the supervisory service is unreachable by the ring of networking devices.

Abstract: According to one or more embodiments of the disclosure, a particular networking device located in a ring of networking devices of a network receives an indication from a supervisory service that the particular networking device has been designated a ring manager for the ring of networking devices. The particular networking device determines that the supervisory service is unreachable by the ring of networking devices. The particular networking device obtains telemetry data regarding a new device connected to the ring of networking devices. The particular networking device onboards, based on the telemetry data, the new device to the network, when the supervisory service is unreachable by the ring of networking devices.

Abstract: This disclosure describes techniques for identifying and reporting a space or individual that has been exposed to an infectious disease. An example method includes identifying sensor data related to one or more individuals in a space; determining, based on the sensor data, that a particular individual among the one or more individuals is infected with an infectious disease; generating a report requesting that the space be disinfected; and outputting the report to a computing device.

Abstract: In one embodiment, a gateway device receives, from a centralized broker device, a data-access policy for a given computer network, the data-access policy defining which of one or more accessing entities are granted access to specific elements of data within the given computer network. When the gateway device then receives, from a particular accessing entity, a request for one or more particular elements of data from within the given computer network, it may determine, based on the data-access policy, whether the particular accessing entity has been granted access to each of the one or more particular elements of data of the request. As such, the gateway device may prevent access for the particular accessing entity to any of the one or more particular elements of the data request to which the particular accessing entity has not been granted access.

Abstract: A network optimization controller (NOC) performs operations including obtaining, from a secure access service edge (SASE) device executing a security service, a first data set defining a security performance metric provided by the security service, and obtaining, from the SASE, a second data set defining a network performance metric associated with a network device. The operations further include defining a policy based at least in part on the first data set and the second data set, determining if the policy has been violated, and changing a first access modality provided for the network device to access an end host to a second access modality based at least in part on the policy being violated. The first access modality and the second access modality define different methods of access to the end host.

Abstract: In one embodiment, a device obtains telemetry data regarding a plurality of traffic flows in a network. The device forms a directed graph based on the telemetry data, wherein nodes of the graph represent devices in the network. The device simulates traffic for one or more of the devices by performing random walks starting at a particular node on the directed graph to generate a set of trails, each trail representing a sequence of one or more flows. The device clusters the set of trails to form one or more clusters. The device generates an application fingerprint for an application based on one of the one or more clusters. The device uses the application fingerprint to identify traffic in the network as associated with the application.

Abstract: In one embodiment, a device obtains telemetry data regarding a plurality of traffic flows in a network. The device forms a directed graph based on the telemetry data, wherein nodes of the graph represent devices in the network. The device simulates traffic for one or more of the devices by performing random walks starting at a particular node on the directed graph to generate a set of trails, each trail representing a sequence of one or more flows. The device clusters the set of trails to form one or more clusters. The device generates an application fingerprint for an application based on one of the one or more clusters. The device uses the application fingerprint to identify traffic in the network as associated with the application.

Abstract: In one embodiment, a processor receives data indicative of a plurality of conversations involving a primary user. The processor identifies a subset of the plurality of conversations that are regarding a particular topic. The processor adds a conversation to the subset based on a match between one or more keywords in the conversation matching a list of keywords associated with the particular topic. The processor uses a machine learning-based model to identify one or more context characteristics of the conversations in the identified subset. The processor updates the subset of conversations by adding at least one of the conversations to the subset based on the at least one conversation having at least one context characteristic identified by the machine learning-based model. The processor provides data indicative of the updated subset of conversations to a user interface for review by the primary user.

Abstract: In one embodiment, a gateway device receives, from a centralized broker device, a data-access policy for a given computer network, the data-access policy defining which of one or more accessing entities are granted access to specific elements of data within the given computer network. When the gateway device then receives, from a particular accessing entity, a request for one or more particular elements of data from within the given computer network, it may determine, based on the data-access policy, whether the particular accessing entity has been granted access to each of the one or more particular elements of data of the request. As such, the gateway device may prevent access for the particular accessing entity to any of the one or more particular elements of the data request to which the particular accessing entity has not been granted access.

Abstract: In one embodiment, a supervisory device in a network, configured to interact with one or more sensors positioned in a given area and with a conference room scheduling service, obtains an acoustic feature of the area from one or more of the sensors. The supervisory device makes a determination that a conference room should be reserved based on the acoustic feature and selects a particular conference room based on the determination that a conference room should be reserved. The supervisory device instructs a conference room scheduling service to reserve the particular conference room.

Abstract: In one embodiment, a gateway device receives, from a centralized broker device, a data-access policy for a given computer network, the data-access policy defining which of one or more accessing entities are granted access to specific elements of data within the given computer network. When the gateway device then receives, from a particular accessing entity, a request for one or more particular elements of data from within the given computer network, it may determine, based on the data-access policy, whether the particular accessing entity has been granted access to each of the one or more particular elements of data of the request. As such, the gateway device may prevent access for the particular accessing entity to any of the one or more particular elements of the data request to which the particular accessing entity has not been granted access.

Abstract: In one embodiment, a device in a network receives sensor data from one or more nodes in the network. The device selects a processing mode from among a plurality of processing modes based on a plurality of attributes of the sensor data. The plurality of processing modes comprises a fast data path mode and a slow data path mode. The device encrypts the sensor data using a first encryption mechanism that controls access to the plurality of attributes of the sensor data. The device sends the encrypted sensor data to a cloud-based intermediary based on the selected processing mode for sharing with one or more other devices in one or more other networks.

Abstract: Presented herein are techniques for automatically creating communities of network-connected devices, i.e., Internet of Thing (IoT) devices. One or more of a plurality of network-connected devices are identified based on one or more policies that define one or more communities of network-connected devices. A community of network-connected devices includes network-connected devices that share common functional, physical or relational attributes. Information is stored that indicates the one or more communities of which each of the one or more of the plurality of network-connected devices is a member based on the policies that define the one or more communities and functional, physical or relational attributes of the one or more of the plurality of network-connected devices.

Abstract: A plurality of data sets are compiled in a memory. A first data set comprises a location mapping of an item of interest within a predetermined environment, and a second set comprises energy usage data within the predetermined environment. The first data set is correlated, via a processor, with the second data set to locate a subset of energy usage data in the second data set associated with the item of interest. A third data set is generated by combining the first data set with the subset of energy usage data in the second data set to increase an accuracy of the location mapping of the item of interest based upon the subset of energy usage data. The third data set is applied to a computing resource.

Abstract: In one embodiment, a processor receives data indicative of a plurality of conversations involving a primary user. The processor identifies a subset of the plurality of conversations that are regarding a particular topic. The processor adds a conversation to the subset based on a match between one or more keywords in the conversation matching a list of keywords associated with the particular topic. The processor uses a machine learning-based model to identify one or more context characteristics of the conversations in the identified subset. The processor updates the subset of conversations by adding at least one of the conversations to the subset based on the at least one conversation having at least one context characteristic identified by the machine learning-based model. The processor provides data indicative of the updated subset of conversations to a user interface for review by the primary user.