Abstract: In one embodiment, a device detects an anomaly in the network based on telemetry data obtained by the device. The device computes an anomaly detection score associated with the anomaly. The device determines that the anomaly should be reported based on its anomaly detection score and in accordance with a configured reporting policy. The device reports anomaly information regarding the anomaly to a cloud-hosted detection engine that evaluates the anomaly information to confirm the anomaly detected by the device.

Abstract: In one implementation, a device extracts event data from logs generated by one or more entities in a computer network that are indicative of events that occurred in the computer network. The device detects, using the event data, a relationship between the events that occurred in the computer network. The device generates, based on the relationship, a prompt for input to a language model. The device provides the prompt to the language model, to generate a summary of the events that occurred in the computer network.

Abstract: In one implementation, a device generates a template for a particular parameter in one or more log files. The device uses a language model to determine a context for the particular parameter based on the template that would be relevant to an administrator. The device generates a visualization of the particular parameter based on the context. The device provides the visualization to a user interface for review by the administrator.

Abstract: In one implementation, a device receives a query from a user for input to a large language model. The device matches a pattern associated with the query with one or more prior chat exchanges between the large language model and one or more other users. The device generates an adjusted query based on the query and the one or more prior chat exchanges. The device provides an answer to the adjusted query from the large language model to the user.

Abstract: In one implementation, a device receives, via a natural language interface agent, an input prompt from a user interface. The device decomposes the input prompt into one or more tasks for performance to produce an answer to the input prompt. The device selects one or more external resources registered in a resource directory for the natural language interface agent based on a semantic relevance between the one or more tasks and information regarding the one or more external resources stored in the resource directory. The device provides the answer to the user interface via the natural language interface agent by performing the one or more tasks using the one or more external resources.

Abstract: A device may obtain a query from a user interface regarding a computer network. The device may retrieve, based on the query, schema metadata from a database. The device may resolve any time ambiguity in the query using the schema metadata. The device may provide an answer to the query to the user interface, after resolving any time ambiguity in the query using the schema metadata.

Abstract: A device may obtain a query from a user interface regarding a computer network. The device may retrieve, based on the query, schema metadata from a database. The device may resolve any time ambiguity in the query using the schema metadata. The device may provide an answer to the query to the user interface, after resolving any time ambiguity in the query using the schema metadata.

Abstract: In one embodiment, a central agent obtains device inventory data from a plurality of networks regarding endpoint devices in those networks. The central agent receives a request for a behavioral model for a particular type of endpoint device. The central agent selects one or more networks of the plurality of networks to export traffic data associated with endpoint devices of the particular type. The central agent configures one or more export agents at the one or more networks to export the traffic data. The traffic data exported by the one or more export agents is used to train the behavioral model.

Abstract: In one implementation, a method is disclosed comprising: determining, by a process, a log template mapped from network monitoring log messages; generating, by the process, a visualization of the log template including interactive graphical representations of a detection frequency for the log template, a frequency distribution of parameter values per parameter for the log template, and relationships between parameter values across different parameters for the log template; filtering, by the process, data included in the visualization based on a user selection of a portion of a particular graphical representation; and modifying, by the process and based on user feedback on the visualization, generation of subsequent visualizations of log templates.

Abstract: In one embodiment, a device determines a criticality of each of a plurality of endpoints in a network, based on network telemetry data regarding the network. The device translates a plurality of anomaly detection models available for deployment to the network and their metadata into a set of adjustable resources. The device generates an anomaly detection deployment strategy for the network by selecting a set of one or more of the plurality of anomaly detection models for deployment to one or more execution points in the network, based on the criticality of each of the plurality of endpoints and on the set of adjustable resources. The device causes the set to be deployed to the one or more execution points in the network, in accordance with the anomaly detection deployment strategy.

Abstract: In one embodiment, a device determines a criticality of each of a plurality of endpoints in a network, based on network telemetry data regarding the network. The device translates a plurality of anomaly detection models available for deployment to the network and their metadata into a set of adjustable resources. The device generates an anomaly detection deployment strategy for the network by selecting a set of one or more of the plurality of anomaly detection models for deployment to one or more execution points in the network, based on the criticality of each of the plurality of endpoints and on the set of adjustable resources. The device causes the set to be deployed to the one or more execution points in the network, in accordance with the anomaly detection deployment strategy.

Abstract: In one embodiment, a device detects an anomaly in the network based on telemetry data obtained by the device. The device computes an anomaly detection score associated with the anomaly. The device determines that the anomaly should be reported based on its anomaly detection score and in accordance with a configured reporting policy. The device reports anomaly information regarding the anomaly to a cloud-hosted detection engine that evaluates the anomaly information to confirm the anomaly detected by the device.

Abstract: In one embodiment, a central agent obtains device inventory data from a plurality of networks regarding endpoint devices in those networks. The central agent receives a request for a behavioral model for a particular type of endpoint device. The central agent selects one or more networks of the plurality of networks to export traffic data associated with endpoint devices of the particular type. The central agent configures one or more export agents at the one or more networks to export the traffic data. The traffic data exported by the one or more export agents is used to train the behavioral model.

Abstract: Improved virtual collaboration environments allow participants in a primary collaboration session to initiate side conversations with fellow participants based on virtual locations of each participant within a virtual collaboration layout. The virtual collaboration layout defines virtual locations of each participant in the collaboration session. If a virtual distance between two participants a below a threshold, the participants are able to engage in a side conversation. Management information is provided to a collaboration session host. The management information indicates, for example, a volume or frequency of communication occurring on each side conversation, or an elapsed time since the side conversation was initiated.

Abstract: Improved virtual collaboration environments allow participants in a primary collaboration session to initiate side conversations with fellow participants based on virtual locations of each participant within a virtual collaboration layout. The virtual collaboration layout defines virtual locations of each participant in the collaboration session. If a virtual distance between two participants a below a threshold, the participants are able to engage in a side conversation. Management information is provided to a collaboration session host. The management information indicates, for example, a volume or frequency of communication occurring on each side conversation, or an elapsed time since the side conversation was initiated.

Abstract: Improved virtual collaboration environments allow participants in a primary collaboration session to initiate side conversations with fellow participants based on virtual locations of each participant within a virtual collaboration layout. The virtual collaboration layout defines virtual locations of each participant in the collaboration session. If a virtual distance between two participants a below a threshold, the participants are able to engage in a side conversation. Management information is provided to a collaboration session host. The management information indicates, for example, a volume or frequency of communication occurring on each side conversation, or an elapsed time since the side conversation was initiated.

Abstract: A three-dimensional image of the eardrum is automatically registered. In one aspect, a three-dimensional image (e.g., depth map) of an eardrum is produced from four-dimensional light field data captured by a light field otoscope. The three-dimensional image is registered according to a predefined standard form. The eardrum is then classified based on the registered three-dimensional image. Registration may include compensation for out-of-plane rotation (tilt), for in-plane rotation, for center location, for translation, and/or for scaling.

Abstract: Eardrums are automatically classified based on a feature set from a three-dimensional image of the eardrum, such as might be derived from a plenoptic image captured by a light field otoscope. In one aspect, a grid is overlaid onto the three-dimensional image of the eardrum. The grid partitions the three-dimensional image into cells. One or more descriptors are calculated for each of the cells, and the feature set includes the calculated descriptors. Examples of descriptors include various quantities relating to the depth and/or curvature of the eardrum. In another aspect, isocontour lines (of constant depth) are calculated for the three-dimensional image of the eardrum. One or more descriptors are calculated for the isocontour lines, and the feature set includes the calculated descriptors. Examples of descriptors include various quantities characterizing the isocontour lines.

Abstract: Eardrums are automatically classified based on a feature set from a three-dimensional image of the eardrum, such as might be derived from a plenoptic image captured by a light field otoscope. In one aspect, a grid is overlaid onto the three-dimensional image of the eardrum. The grid partitions the three-dimensional image into cells. One or more descriptors are calculated for each of the cells, and the feature set includes the calculated descriptors. Examples of descriptors include various quantities relating to the depth and/or curvature of the eardrum. In another aspect, isocontour lines (of constant depth) are calculated for the three-dimensional image of the eardrum. One or more descriptors are calculated for the isocontour lines, and the feature set includes the calculated descriptors. Examples of descriptors include various quantities characterizing the isocontour lines.

Abstract: A three-dimensional image of the eardrum is automatically registered. In one aspect, a three-dimensional image (e.g., depth map) of an eardrum is produced from four-dimensional light field data captured by a light field otoscope. The three-dimensional image is registered according to a predefined standard form. The eardrum is then classified based on the registered three-dimensional image. Registration may include compensation for out-of-plane rotation (tilt), for in-plane rotation, for center location, for translation, and/or for scaling.