Abstract: A correlation engine and policy manager (CPE) system includes: a persistent database, a cache database, an event gate, an event enricher, an event transformer, and an event dispatcher. The event gate obtains event data from at least one event source, and forwards the event data to the event enricher. The event enricher enriches the event data with additional data in the cached business layer data of the cache database, and forwards the enriched event data to the event transformer. The event transformer applies one or more policies in a cached business layer data of the cache database to the enriched event data to obtain transformed event data, and outputs the transformed event data to be stored in the persistent database. The event dispatcher dispatches output data to cause or prompt an action responsive to the transformed event data satisfying the at least one policy.

Abstract: A system includes processing circuitry; and a memory connected to the processing circuitry, wherein the memory is configured to store executable instructions that, when executed by the processing circuitry, facilitate performance of operations, including: receive an event message frame from a data source, wherein the event message frame is generated by one or more state changes within a network operatively connected to the system; correlate one or more business policies based the event message frame; apply the one or more operations to the event message frame based on the one or more business policies to create a transformed event message frame; and route the transformed event message frame to a message queue.

Abstract: A system includes processing circuitry and a memory connected to the processing circuitry. The memory is configured to store executable instructions that, when executed by the processing circuitry, facilitate performance of operations. The operations include filtering, based upon business logic, business data within a cache database. Converting the filtered business data into a data model. Loading the data model to a persistent cache database. Obtaining event messages from a data source, where the event messages are generated by one or more state changes within a network operatively connected to the system. Obtaining, for an event message, event-related data from the data model, where the event-related data is topologically related to the event message. Combining the event message with the event-related data from the data model. Framing the event message with the event-related data; and route the frame according to a user-defined configuration file.

Abstract: An application programming interface (API) server for a correlation engine and policy manager (CPE) system includes a processor, and a memory coupled to the processor. The CPE system includes a plurality of components of various component types, and each component among the plurality of components is configured to perform at least one corresponding processing on event data input to the CPE system. The memory is configured to store executable instructions that, when executed by the processor, cause the processor to perform at least one of registering, removing or updating a configuration of at least one component among the plurality of components of the CPE system, or changing a number of components of a same component type among the various component types, to scale up or down the CPE system.

Abstract: A system includes processing circuitry and a memory connected to the processing circuitry. The memory is configured to store executable instructions that, when executed by the processing circuitry, cause the processing circuitry to startup a configuration parser module and an invoke worker module. To obtain a configuration file from a database where the configuration file specifies configuration information for constructing a pluggable event gate that includes a data adaptor for an online source, a data adaptor for an offline source, a data adaptor sink. To construct one or more event gates based on the configuration file. The configuration file further specifies one or more user-defined data sources and one or more user-defined data sinks. To create, responsive to a number of the user-defined data sources and a number of user-defined data sinks, multiprocessing workers located on one or more cores of a network and share data between the multiprocessing workers.

Abstract: A method includes processing event data to detect a status of a network function. The event data is processed based on two or more conditions defined by a correlation policy. The correlation policy includes a non-deterministic finite automata tree (NFAT) structure correlation policy having a policy type and a logic-gate. The method additionally includes determining the policy type of the NFAT structure correlation policy. The method also includes determining whether a first value of the two or more conditions is indicative of whether a first condition is satisfied. The method further includes determining whether a second value of the two or more conditions is indicative of whether the second condition is satisfied. The method additionally includes determining whether the NFAT structure correlation policy is satisfied based on the first value, the second value, the logic-gate and the policy type.

Abstract: A method includes processing event data to detect a status of a network function. The event data is processed based on two or more conditions defined by a correlation policy. The correlation policy includes a non-deterministic finite automata tree (NFAT) structure correlation policy having a policy type. The method also includes determining a first value of a first condition of the two or more conditions. The method further includes determining a second value of a second condition of the two or more conditions. The method additionally includes determining the policy type of the NFAT structure correlation policy. The method also includes determining whether the first value is greater than a first preset value indicative of whether the first condition is satisfied. The method further includes determining whether the second value is greater than a second preset value indicative of whether the second condition is satisfied.

Abstract: A method includes causing a message bus to send event data received from an observability framework to one or more data enrichers based on a multi-layered correlation policy. The multi-layered correlation policy is communicated to the message bus by a policy definition manager. The policy definition manager is connected to a database that includes a plurality of rules associated with monitoring and modifying one or more network functions associated with a communication network. The policy definition manager is configured to generate the multi-layered correlation policy based on one or more of the rules. The method also includes causing a policy action manager to trigger an operation to be performed by a lifecycle manager. The operation is defined by the multi-layered correlation policy as an action caused to occur based on a determination of whether the event data satisfies one or more conditions defined by the multi-layered correlation policy.

Abstract: A method includes processing a user input for generating a non-deterministic finite automata tree (NFAT) correlation policy. The user input indicates one or more of a static condition or a dynamic condition for inclusion in the NFAT correlation policy. The static condition includes a comparison between a defined entity and a first fixed parameter. The dynamic condition includes a comparison between the defined entity and a variable parameter. An applicable NFAT element is generated that includes at least one of the NFAT correlation policy generated based on a determination that the user input indicates the static condition or a NFAT template generated based on a determination that the user input indicates the dynamic condition. Event data received from a network device is processed to detect a status of a network entity associated with a communication network based on the applicable NFAT element.