Abstract: A system may identify a security intent policy model associated with an initial time. The system may generate one or more delta snapshots that respectively indicate one or more incremental changes to the security intent policy model at times subsequent to the initial time. The system may determine that the system is to deploy an updated version of the security intent policy model to a device and may thereby determine a previous deployment time at which the system deployed a previous version of the security intent policy model to the device. The system may generate, based on the one or more delta snapshots and the previous deployment time, a cumulative delta snapshot, and may thereby update a low-level security intent policy model associated with the device. The system may generate, based on the low-level security intent policy model, device-level security configuration information for the device.

Abstract: Network elements are managed with a server to support client data models from heterogeneous data sources. A server receives a first query for configuration data of a network element to be returned in a first model. The server determines a model type for the configuration data of the network element. When the model type is a second model that is not the first model, the server sends a second query to the network element for the configuration data to be returned in the second model and transforms the configuration data received from the network element into the first model. Additionally, the server returns the configuration data in the first model as a response to the first query.

Abstract: In some implementations, one or more network devices may receive, by one or more network devices associated with a first point of presence (POP) in a first cloud deployment, a message associated with a tenant. The one or more network devices may identify based at least in part on the message, one or more second POPs, associated with the tenant, in one or more second cloud deployments. The one or more network devices may transmit the message to the one or more second POPs.

Abstract: A system identifies a source intent policy model that is associated with a graph having a plurality of source nodes connected by a plurality of source edges, identifies a set of source nodes of the plurality of source nodes, and translates the set of source nodes to generate a set of target nodes. The system identifies a subset of target nodes, of the set of target nodes, that are not included in a target intent policy model that is associated with a graph having a plurality of target nodes connected by a plurality of target edges. The system determines a hierarchical order associated with the subset of target nodes and the plurality of target node, and causes the target intent policy model to be updated to include the subset of target nodes and the plurality of target nodes, such that the graph is ordered according to the hierarchical order.

Abstract: A system identifies an intent policy model associated with an initial time. The system updates a data structure to cause the data structure to include one or more portions. Each portion of the data structure is associated with a start time and an end time. Each portion includes: a first delta snapshot that indicates one or more first changes to the intent policy model from the initial time to the start time associated with the portion, and one or more additional delta snapshots that respectively indicate one or more incremental changes to the intent policy model at times from the start time and to the end time associated with the portion of the data structure.

Abstract: A controller device manages a plurality of network devices. The controller device includes one or more processing units configured to receive an indication of a stateful intent, the data structure including a plurality of nodes and a plurality of edges, each node of the plurality of nodes being representative of a respective network device of the plurality of network devices. The one or more processing units are configured to determine, using an abstract function configured at a node of the plurality of nodes, a stateless intent for implementing the stateful intent and generate low level configuration data for the plurality of network devices based on the stateless intent. The one or more processing units are configured to interface with one or more of the plurality of network devices to configure the one or more of the plurality of network devices with the low level configuration data.

Abstract: A system determines identification information associated with an endpoint device, which is associated with a tenant of the system, and the tenant. The system generates and sends, to the endpoint device, a certificate that includes the identification information. The system receives, from the endpoint device and as part of an attempt by the endpoint device to initiate a dial-out communication session with the system, the certificate. The system causes, based on the certificate, the dial-out communication session to be established and processes the certificate to determine the identification information. The system receives, from the endpoint device and via the dial-out communication session, one or more messages; modifies the one or more messages to include the identification information; and provides the one or more modified messages to facilitate provisioning of services or resources associated with the system to the endpoint device.

Abstract: A system identifies an intent policy model associated with an initial time. The system updates a data structure to cause the data structure to include one or more portions. Each portion of the data structure is associated with a start time and an end time. Each portion includes: a first delta snapshot that indicates one or more first changes to the intent policy model from the initial time to the start time associated with the portion, and one or more additional delta snapshots that respectively indicate one or more incremental changes to the intent policy model at times from the start time and to the end time associated with the portion of the data structure.

Abstract: A device may receive license data identifying device licenses and organization licenses associated with an organization of users of a multi-tenant system, and may identify, in the license data, entitlements for licenses associated with the organization. The device may combine the entitlements to generate combined entitlements, and may determine an entitlement count of the combined entitlements. The device may add quantities of new entitlements to the entitlement count, and may identify, in the license data, roles of the users and capabilities associated with each of the roles. The device may map the entitlements and the capabilities to generate a mapping, and may authorize a particular user based on the mapping. The device may process usage of the entitlements, with a machine learning model, to predict future usage of the entitlements, and may determine entitlement recommendations based on the future usage. The device may provide the entitlement recommendations for display.

Abstract: A device may receive license data identifying device licenses and organization licenses associated with an organization of users of a multi-tenant system, and may identify, in the license data, entitlements for licenses associated with the organization. The device may combine the entitlements to generate combined entitlements, and may determine an entitlement count of the combined entitlements. The device may add quantities of new entitlements to the entitlement count, and may identify, in the license data, roles of the users and capabilities associated with each of the roles. The device may map the entitlements and the capabilities to generate a mapping, and may authorize a particular user based on the mapping. The device may process usage of the entitlements, with a machine learning model, to predict future usage of the entitlements, and may determine entitlement recommendations based on the future usage. The device may provide the entitlement recommendations for display.

Abstract: A system identifies an intent policy model associated with an initial time. The system updates a data structure to cause the data structure to include one or more portions. Each portion of the data structure is associated with a start time and an end time. Each portion includes: a first delta snapshot that indicates one or more first changes to the intent policy model from the initial time to the start time associated with the portion, and one or more additional delta snapshots that respectively indicate one or more incremental changes to the intent policy model at times from the start time and to the end time associated with the portion of the data structure.

Abstract: A system may identify a security intent policy model associated with an initial time. The system may generate one or more delta snapshots that respectively indicate one or more incremental changes to the security intent policy model at times subsequent to the initial time. The system may determine that the system is to deploy an updated version of the security intent policy model to a device and may thereby determine a previous deployment time at which the system deployed a previous version of the security intent policy model to the device. The system may generate, based on the one or more delta snapshots and the previous deployment time, a cumulative delta snapshot, and may thereby update a low-level security intent policy model associated with the device. The system may generate, based on the low-level security intent policy model, device-level security configuration information for the device.

Abstract: Techniques are disclosed for managing a network. In one example, a device configuration manager is configured to generate, in accordance with a device management protocol, a configuration change request representing a transaction having a first sub-transaction specifying a first configuration change for a network device of the network and a second sub-transaction specifying a second configuration change for the same network device. The device configuration manager is further configured to output the configuration change request to the network device and receive a reply message from the network device. The reply message includes a first response element specifying whether the first configuration change is successfully committed at the network device and a second response element specifying whether the second configuration change is successfully committed at the network device.

Abstract: A controller device manages a plurality of network devices. The controller device includes one or more processing units configured to receive an indication of a stateful intent, the data structure including a plurality of nodes and a plurality of edges, each node of the plurality of nodes being representative of a respective network device of the plurality of network devices. The one or more processing units are configured to determine, using an abstract function configured at a node of the plurality of nodes, a stateless intent for implementing the stateful intent and generate low level configuration data for the plurality of network devices based on the stateless intent. The one or more processing units are configured to interface with one or more of the plurality of network devices to configure the one or more of the plurality of network devices with the low level configuration data.

Abstract: Some implementations described herein relate to a system that is configured to obtain one or more event logs associated with a tenant of the system. The system may be configured to determine, based on the one or more event logs, an event rate associated with the tenant and thereby determine, based on the event rate, a rotation interval. The system may be configured to cause, based on the rotation interval, a data structure to be generated for storing event logs associated with the tenant that are obtained during a time window. The system may be configured to obtain, within the time window, one or more additional event logs associated with the tenant and to cause, based on obtaining the one or more additional event logs within the time window, the one or more additional event logs to be stored in the data structure.

Abstract: Network management techniques are described. A controller device of this disclosure manages a device group of a network. The controller device includes processing circuitry in communication with the memory, the processing circuitry being configured to receive, using a programmable diagnosis service executed by the processing circuitry, a programming input, to form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, to detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources, and to identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.

Abstract: A system identifies a source intent policy model that is associated with a graph having a plurality of source nodes connected by a plurality of source edges, identifies a set of source nodes of the plurality of source nodes, and translates the set of source nodes to generate a set of target nodes. The system identifies a subset of target nodes, of the set of target nodes, that are not included in a target intent policy model that is associated with a graph having a plurality of target nodes connected by a plurality of target edges. The system determines a hierarchical order associated with the subset of target nodes and the plurality of target node, and causes the target intent policy model to be updated to include the subset of target nodes and the plurality of target nodes, such that the graph is ordered according to the hierarchical order.

Abstract: An example method includes obtaining, by one or more processors, data indicating resource dependencies between a plurality of resources in a network and event dependencies between a plurality of network events and one or more of the plurality of resources; generating a Bayesian model based on resource types of the plurality of resources and event types of the plurality of network events; receiving an indication of a fault in the network; collecting fault data and generating, based on the Bayesian model and the fault data, a plurality of root cause hypotheses for the fault; ordering the plurality of root cause hypotheses based on respective root cause probabilities associated with the plurality of root cause hypotheses; and outputting the ordered plurality of root cause hypotheses.

Abstract: A controller device manages a plurality of network devices. The controller device includes one or more processing units configured to receive an upgrade request; obtain a redundancy model indicating network device redundancies or service redundancies; determine, based on the upgrade request and the redundancy model, an update graph having nodes each representing one of the network devices or one of the services, the update graph also having at least one edge that connects two of the nodes and that indicates the network redundancy or the service redundancy; determine, based on the update graph including the at least one edge, an update schedule for performing an update of software for the network devices that ensures availability for the first network device or second network device or availability for the service; and update the software of each of the network devices according to the update schedule.

Abstract: Network management techniques are described. A controller device of this disclosure manages a device group of a network. The controller device includes processing circuitry in communication with the memory, the processing circuitry being configured to receive, using a programmable diagnosis service executed by the processing circuitry, a programming input, to form, using the programmable diagnosis service, based on the programming input, a resource definition graph that models interdependencies between a plurality of resources supported by the device group, to detect, using the programmable diagnosis service, an event affecting a first resource of the plurality of resources, and to identify, using the programmable diagnosis service, based on the interdependencies modeled in the resource definition graph formed based on the programming input, a root cause event that caused the event affecting the first resource, the root cause event occurring at a second resource of the plurality of resources.