Abstract: Techniques are described for monitoring network performance and managing network faults in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system determines, based on the path data, one or more WAN link health assessments, wherein the one or more WAN link health assessments include a success or failure state associated with one or more of service provider reachability, physical interface operation, or logical path performance; and in response to determining the at least one failure state, outputs a notification including identification of a root cause of the at least one failure state.

Abstract: Disclosed are embodiments for automatically resolving faults in a complex network system. Some embodiments monitor one or more of system operational parameter values and message exchanges between network components. A machine learning model detects a fault in the complex network system, and an action is selected based on a cause of the fault. After the action is applied to the complex network system, additional monitoring is performed to either determine the fault has been resolved or additional actions are to be applied to further resolve the fault.

Abstract: Techniques are described for identifying, by a network management system (NMS), a seasonal pattern of device counts collected at a site over time; predicting, by the NMS, device counts for a time window based on the seasonal pattern and device counts determined for one or more prior time windows; detecting, by the NMS, an anomaly during the time window based on a difference between actual device counts determined for the time window and the predicted device counts for the time window; and determining, by the NMS, a root cause of the anomaly at the site.

Abstract: This disclosure describes a network management system (NMS) configured to determine a particular network device of a plurality of network devices based on a first user input in a conversational assistant. The one or more processors are further configured to identify a set of actionable insights for the particular network device based on network data received from the plurality of network devices and determine a set of views of a dashboard based at least on the set of actionable insights, wherein each view of the set of views displays a portion of the network data received from the plurality of network devices. The one or more processors are further configured to select a view of the set of views of the dashboard based on a second user input in the conversational assistant and cause the dashboard to display the selected view.

Abstract: Techniques are disclosed for sending downloadable software packages that may be executed to perform tests of a network device without requiring the network device to update firmware. In one example, the network device obtains a software package comprising instructions for simulating a network instance and stores the software package in a volatile memory of the network device. The network device simulates, based on the instructions, the network instance to obtain data indicative of a performance of the network instance. The network device sends, via a communication channel established with a network management system (NMS) based on the software package, the data indicative of the performance of the network instance. In some examples, the NMS uses the data indicative of the performance of the network instance to identify a root cause of a failure of the network device or a remedial action to be performed upon the network device.

Abstract: Techniques are described for determining a root cause of a networking loop that occurred at one or more access points. The techniques include a network management system (NMS) configured to obtain information of a plurality of network devices that indicate a plurality of network events comprising at least a networking loop event that occurred at an access point of the plurality of network devices and one or more network events that occurred at an upstream device to the access point; determine, based on correlating the plurality of network events, whether the one or more network events that occurred at the upstream device is a root cause of the networking loop event; and perform, based on determining that the one or more network events that occurred at the upstream device is a root cause of the networking loop event, an action to remedy the networking loop event.

Abstract: An example method includes receiving, from a network device, data indicating characterizations of network traffic on a plurality of ports of the network device; determining, by processing circuitry, for each port of the plurality of ports, an indicator of a port type for the port based on the data indicating the characterizations of network traffic on the plurality of ports, wherein the port type indicates a link type of network traffic exchanged by the port; and outputting, by the processing circuitry, the indicator of the port type to an output device.

Abstract: A network management system includes a memory and processing circuitry in communication with the memory. The processing circuitry is configured to obtain connection event data. The connection event data indicates a plurality of disconnection events. The processing circuitry is also configured to generate, from the connection event data, aggregate data according to a plurality of network scope levels and detect, based on the aggregate data, one or more network anomalies. Additionally, the processing circuit is configured to determine, based on the aggregate data, whether a root cause of the one or more network anomalies is associated with each network scope level of the plurality of network scope levels and output an indication of the determined network scope level associated with the root cause or performing a remedial action to address the root cause at the determined network scope level.

Abstract: Techniques are disclosed for a network management system (NMS) that performs quality of service (QoS) monitoring and troubleshooting of user experience issues occurring outside of a network managed by the NMS using data obtained from third-party sources. For example, an NMS obtains third-party data of a third-party application server or third-party service provider server from a third-party monitoring vendor. The NMS identifies a user experience issue indicated by the third-party data and stitches the third-party data to network data received from network devices. The NMS determines a root cause or a remedial action of the user experience issue based at least on the network data received from the one or more network devices. The NMS generates a notification for presentation to an administrator device which identifies the root cause or the remedial action of the user experience issue.

Abstract: Techniques are described for predicting a wide area network (WAN) issue based on detection of service provider connection swapping. A cloud-based network management system (NMS) obtains connection event data for one or more network access server (NAS) devices at a site, where each event included in the connection event data comprises a connection or disconnection event of a connection session provided by a service provider. The NMS detects a number of connection swaps in the connection event data over a time window, where a connection swap includes a change from a first connection session provided by a first service provider to a second connection session provided by a second service provider. Based on the detected number of connection swaps satisfying a threshold, the NMS predicts a root cause of the connection swaps as a WAN issue and generates a notification of the predicted root cause of the connection swaps.

Abstract: Techniques are described for monitoring network performance and managing network faults in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system determines, based on the path data, one or more WAN link health assessments, wherein the one or more WAN link health assessments include a success or failure state associated with one or more of service provider reachability, physical interface operation, or logical path performance; and in response to determining the at least one failure state, outputs a notification including identification of a root cause of the at least one failure state.

Abstract: A network management system (NMS) generates a hierarchical attribution graph representing different scopes at different hierarchical levels of a wide area network (WAN); obtains logical path down data indicative of operational behavior including failure events associated with logical paths of network devices over the WAN; obtains total path data indicative of a historical number of active logical paths between the network devices; and determines a scope of a logical path down issue by, for a time period of the logical path down issue, determining a score for each scope of the different scopes based on the logical path down data aggregated across the respective scope and the total path data, and determining the scope of the logical path down issue as a particular scope of the different scopes having a highest score. The NMS may identify the particular scope as a root cause of the logical path down issue.

Abstract: Techniques are disclosed for a network management system (NMS) that performs quality of service (QoS) monitoring and troubleshooting of user experience issues occurring outside of a network managed by the NMS using data obtained from third-party sources. For example, an NMS obtains third-party data of a third-party application server or third-party service provider server from a third-party monitoring vendor. The NMS identifies a user experience issue indicated by the third-party data and stitches the third-party data to network data received from network devices. The NMS determines a root cause or a remedial action of the user experience issue based at least on the network data received from the one or more network devices. The NMS generates a notification for presentation to an administrator device which identifies the root cause or the remedial action of the user experience issue.

Abstract: Disclosed is a network management system that provides an interface to enable diagnostics and troubleshoot of a remotely managed multi-site network. Some embodiments provide a natural language interface, while other embodiments provide a chatbot type interface that communicates with a technician via traditional text information on a display screen. The diagnostic and troubleshooting capabilities search a central data store that receives device property information from each site of the multi-site network. Based on devices or users that match portions of the entity, queries to the data store are initiated to obtain additional data on the devices. A response to the query is then provided based on the properties of the devices.

Abstract: Various aspects of the subject technology relate to systems, methods, and machine-readable media for a learning platform that employs machine learning to identify patterns that describe meaningful subgroups of patients associated with a particular disease, distinct characteristics of each subgroup, and implications of belonging to a specific subgroup in terms of developing into a more severe disease state for patient journey mapping. The system may include a mapping server that includes a medical-event embedding engine that embeds electronic health records into vectors, a clustering engine that identifies clusters of patients with similar patient journeys by operating on the output of the medical-event embedding engine, and a cluster profiling engine that identifies distinguishing medical events for each identified cluster by operating on the output of the clustering engine.

Abstract: Disclosed is a network management system that provides an interface to enable diagnostics and troubleshoot of a remotely managed multi-site network. Some embodiments provide a natural language interface, while other embodiments provide a chatbot type interface that communicates with a technician via traditional text information on a display screen. The diagnostic and troubleshooting capabilities search a central data store that receives device property information from each site of the multi-site network. Based on devices or users that match portions of the entity, queries to the data store are initiated to obtain additional data on the devices. A response to the query is then provided based on the properties of the devices.

Abstract: An example system is configured to: identify, using network data for a plurality of network devices, a first network device of the plurality of network devices with which a network connection has a connectivity issue; identify, based on a network representation generated from the network data, one or more second network devices from the plurality of network devices that are connected to the first network device; identify a root cause of the connectivity issue based on analysis of the network connection with the first network device using the network data; and send, based on the identified root cause of the connectivity issue, to at least one of the one or more second network devices, instructions for the first network device to perform an action to remediate the connectivity issue, wherein the at least one of the one or more second network devices communicates the instructions to the first network device.

Abstract: Disclosed are embodiments for automatically resolving faults in a complex network system. Some embodiments monitor one or more of system operational parameter values and message exchanges between network components. A machine learning model detects a fault in the complex network system, and an action is selected based on a cause of the fault. After the action is applied to the complex network system, additional monitoring is performed to either determine the fault has been resolved or additional actions are to be applied to further resolve the fault.