Abstract: A network includes a workflow management system coupled to an administrator device, and servers coupled to a user device. A network change auditing system receives and stores workflow definitions from the workflow management system that are associated with respective workflows provided by the servers. The network change auditing system receives and stores activity events from the servers that are associated with instructions from user devices to the servers. The network change auditing system associates a first subset of the activity events with a first workflow based on the first subset of the activity events being defined by a first workflow definition. The network change auditing system receives an identification of a first activity event from an administrator device and, in response, provides an identification of the first workflow and at least one second activity event in the first subset of the activity events for display on the administrator device.

Abstract: Network devices can be registered to access a network using known host devices to thereby simplify the device registration process. The host device can be an administrator's device that is already registered and authorized to vouch for another user desiring to register his or her device. Alternatively, the host device can be the user's previously registered device and can be used to register the user's additional devices.

Abstract: Systems and techniques for determining and displaying risk indicators are described. A set of event logs occurring in a time interval and associated with a user account retrieving may be retrieved from an event log database. For individual event logs in the set of event logs, a context may be determined. A resource associated with the individual log may have an associated classification. An activity risk associated with the individual event log may be determined based at least in part on the first context and, if applicable, on the associated classification. For individual event logs in the set of event logs, a risk indicator may be determined based at least in part on the activity risk. In some cases, a cumulative risk indicator may be determined for the particular time interval based on the risk indicators associated with the individual event logs.

Abstract: Systems and techniques to identify and modify unused (or seldom used) access privileges are described. Group membership data may be correlated with access map data to create a user-resource access map identifying privilege levels associated with individual user accounts to access computing resources in a computing system. User activity event logs generated as a result of user accounts accessing the resources may be correlated with the user-resource access map to identify user accounts that do not use (or seldom use) particular privilege levels to access particular resources. The identified user accounts may be modified to remove the unused (or seldom used) privileges levels.

Abstract: In some implementations, a software application may be changed from a standard mode to a tutorial mode, decoupling a user interface of the software application from a standard mode portion of the software application that provides a standard functionality and coupling the user interface to a tutorial mode portion of the software application that provides a tutorial functionality. The software application may administer a test associated with a tutorial, and determine results associated with the test. The software application may determine that the results fail to satisfy a threshold, obtain data identifying a set of one or more mentors knowledgeable about the test, and display the data. The data may include contact information associated with individual mentors of the set of mentors. The software application may automatically initiate a communication session between a computing device executing the software application and a computing device associated with one of the mentors.

Abstract: A system, method, and computer-readable medium for performing an authentication operation comprising: identifying a plurality of user devices associated with a user of an information handling system; determining when at least some of the plurality of user devices are within a predetermined range of the information handling system; and, authenticating the user as an authorized user of the information handling system when at least some of the plurality of user devices are within the predetermined range of the information handling system.

Abstract: A system, method, and computer-readable medium are disclosed for collecting and transmitting diagnostics information via a diagnostic information operation. The diagnostic information operation begins with a system periodically writing diagnostic information such as diagnostic errors and warnings to non-volatile local storage contained within the system. Upon detection of a failure, the user activates an NFC-enabled device (such as a mobile device) and positions the NFC-enabled device within NFC range of the failed system. The failed system then communicates the diagnostic information stored within the non-volatile local storage to NFC-enabled device.

Abstract: Systems and techniques to create a cloud-based replica system using configuration information gathered by agents deployed in the computing system are described. A replication server may remove customer-specific data from the configuration information. The replication server may identify domains of the cloud-based replica system which are not associated with recreating a problem and remove the domains from the cloud-based replica system. The cloud-based replica system may include multiple virtual hardware components. Individual virtual components of the multiple virtual hardware components may correspond to individual hardware components of the multiple hardware components. The replication server may create simulated users with replicated permissions and replicated credentials to simulate activities in the cloud-based replica system. The simulated activities may enable the problem to be recreated in the cloud-based replica system.

Abstract: Systems and techniques for identifying potential problems associated with deploying a software package in a computing system are described. The software package may include multiple components that are installed in various locations in the computing system. Multiple agents that perform mock activities emulating the activities of the multiple components may be deployed in the computing system. Activity data may be gathered when the multiple agents are performing the mock activities and used to identify potential problems.

Abstract: Systems and techniques for displaying timelines of event logs are described. A software application may identify event logs associated with an identifier, such as an IP address of a network element or a username. The software application may group the identified event logs based on specified criteria. The software application may determine multiple sessions in which an individual session includes a group of event logs arranged along a timeline. Sessions associated with a same network element may be displayed with a same magnitude. Sessions associated with different network elements may be displayed with different magnitudes. For example, a first timeline of event logs in a first session at a first network element may be displayed at a first height. A second timeline of event logs in a second session at a second network element may be displayed at a second height.

Abstract: In one embodiment, a method includes initializing a software application operable to switch between a standard mode and a tutorial mode. The software application includes a standard function set, a tutorial function set, and a user interface operable to supply events. The method further includes, in the standard mode, routing the events to the standard function set. In addition, the method includes, in the tutorial mode, diverting the events to the tutorial function set.

Abstract: Systems and techniques for managing alert profiles, including creating the alert profiles and deactivating the alert profiles, are described. Auditing software executing on a central server may receive an event log from a software agent. The event log may identify activities associated with a network element in a computer system. The auditing software may include a classifier trained using machine learning. The auditing software may determine that the event log is indicative of an interesting activity, such as malicious activity. The auditing software may create an alert profile. The auditing software may assign a severity to the alert profile. The auditing software may determine whether the alert profile is relevant. The auditing software may deactivate the alert profile based on determining that the alert profile is not relevant.

Abstract: A system for monitoring devices in a network comprising a coordinator operating on a first processor and configured to detect a plurality of active devices and to install an audit agent on each of the plurality of active devices. The audit agents configured to obtain configuration data for the active device that they are installed on using a processor of the active device, and to obtain configuration for each of a plurality of passive devices that the active device can access, where the passive devices are unable to support installation of an audit agent, and to transmit the configuration data to the coordinator. The coordinator configured to receive the configuration data for the active device and for the passive devices and to store the configuration data in a format that allows the configuration data to be selectively retrieved for the active device and the passive devices.