# US 12,113,833 B2 · Distributed network and security operations platform > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,833 B2 - Document ID: US12113833B2 - Status: Granted - Kind: B2 - Application number: 18/140,987 - Filed: 2023-04-28 - Published: 2023-11-02 - Granted: 2024-10-08 - Earliest claimed: 2018-10-26 - Assignees: Netography, Inc. - Applicants: Netography, Inc. - Inventors: Barrett Lyon; Daniel Murphy - Web page: https://patentgrep.com/patent/US12113833B2 ## CPC - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 9/453: {Help systems} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 45/02: Topology update or discovery - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 45/74: Address processing for routing - H04L 51/02: using automatic reactions or user delegation, e.g. automatic replies or chatbot-generated messages - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0263: {Rule management} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A distributed network and security operations platform is disclosed. The disclosed platform comprises an external service that facilitates network and security operations for a private network. Data from nodes of the private network is received and analyzed by the service, and an output is automatically generated by the service in response to analyzing received data that facilitates modifying the routing performed by at least one or more of the nodes of the private network. ## Claims ### Claim 1 A method, comprising: receiving data from edge nodes of a private network at an external service, wherein the external service provides a synthetic border for the private network that unifies edge nodes of the private network comprising physical devices of the private network and virtual services provided to the private network by third-party providers; analyzing the received data at the external service; and automatically generating an output from the external service in response to analyzing the data that is communicated to and facilitates a corresponding action at least at one or more edge nodes of the private network. ### Claim 2 (depends on 1) The method of claim 1, wherein the data comprises a data stream. ### Claim 3 (depends on 1) The method of claim 1, wherein the data comprises sampled data. ### Claim 4 (depends on 1) The method of claim 1, wherein the data comprises flow data. ### Claim 5 (depends on 1) The method of claim 1, wherein the external service provides network and security operations for the private network. ### Claim 6 (depends on 1) The method of claim 1, wherein the external service facilitates managing and optimizing performance of the private network. ### Claim 7 (depends on 1) The method of claim 1, wherein the external service facilitates defending the private network from threats and attacks. ### Claim 8 (depends on 1) The method of claim 1, wherein the external service comprises a distributed intrusion detection and prevention system. ### Claim 9 (depends on 1) The method of claim 1, further comprising indexing the received data for searchability at the external service. ### Claim 10 (depends on 1) The method of claim 1, further comprising tagging the received data with metadata at the external service. ### Claim 11 (depends on 1) The method of claim 1, further comprising storing the received data at the external service. ### Claim 12 (depends on 1) The method of claim 1, wherein analyzing the received data at the external service comprises detecting a network performance or security event. ### Claim 13 (depends on 1) The method of claim 1, wherein the output is generated by a rules engine of the external service that is configured to map a detected event to the action. ### Claim 14 (depends on 1) The method of claim 1, wherein the corresponding action facilitated by the output generated by the external service comprises modifying routing. ### Claim 15 (depends on 1) The method of claim 1, wherein the corresponding action facilitated by the output generated by the external service comprises remediating a detected security event. ### Claim 16 (depends on 1) The method of claim 1, wherein the corresponding action facilitated by the output generated by the external service modifies network operation. ### Claim 17 (depends on 1) The method of claim 1, wherein the corresponding action facilitated by the output generated by the external service modifies security policy. ### Claim 18 (depends on 1) The method of claim 1, further comprising providing a portal to the external service that is accessible to an operator of the private network. ### Claim 19 A system, comprising: one or more databases of an external service that is external to a private network configured to store data associated with the private network; and one or more processors of the external service configured to: receive data from edge nodes of the private network, wherein the external service provides a synthetic border for the private network that unifies edge nodes of the private network comprising physical devices of the private network and virtual services provided to the private network by third-party providers; analyze the received data at the external service; and automatically generate an output from the external service in response to analyzing the data that is communicated to and facilitates a corresponding action at least at one or more edge nodes of the private network. ### Claim 20 (depends on 19) The system of claim 19, wherein the data comprises a data stream. ### Claim 21 (depends on 19) The system of claim 19, wherein the data comprises sampled data. ### Claim 22 (depends on 19) The system of claim 19, wherein the data comprises flow data. ### Claim 23 (depends on 19) The system of claim 19, wherein the external service provides network and security operations for the private network. ### Claim 24 (depends on 19) The system of claim 19, wherein the external service facilitates managing and optimizing performance of the private network. ### Claim 25 (depends on 19) The system of claim 19, wherein the external service facilitates defending the private network from threats and attacks. ### Claim 26 (depends on 19) The system of claim 19, wherein the external service comprises a distributed intrusion detection and prevention system. ### Claim 27 (depends on 19) The system of claim 19, wherein at least one processor of the one or more processors of the external service is further configured to index the received data for searchability at the external service. ### Claim 28 (depends on 19) The system of claim 19, wherein at least one processor of the one or more processors of the external service is further configured to tag the received data with metadata at the external service. ### Claim 29 (depends on 19) The system of claim 19, wherein at least one processor of the one or more processors of the external service is further configured to store the received data at the external service. ### Claim 30 (depends on 19) The system of claim 19, wherein to analyze the received data at the external service comprises to detect a network performance or security event. ### Claim 31 (depends on 19) The system of claim 19, wherein the output is generated by a rules engine of the external service that is configured to map a detected event to the action. ### Claim 32 (depends on 19) The system of claim 19, wherein the corresponding action facilitated by the output generated by the external service comprises modifying routing. ### Claim 33 (depends on 19) The system of claim 19, wherein the corresponding action facilitated by the output generated by the external service comprises remediating a detected security event. ### Claim 34 (depends on 19) The system of claim 19, wherein the corresponding action facilitated by the output generated by the external service modifies network operation. ### Claim 35 (depends on 19) The system of claim 19, wherein the corresponding action facilitated by the output generated by the external service modifies security policy. ### Claim 36 (depends on 19) The system of claim 19, wherein at least one processor of the one or more processors of the external service is further configured to provide a portal to the external service that is accessible to an operator of the private network. ### Claim 37 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: receiving data from edge nodes of a private network at an external service, wherein the external service provides a synthetic border for the private network that unifies edge nodes of the private network comprising physical devices of the private network and virtual services provided to the private network by third-party providers; analyzing the received data at the external service; and automatically generating an output from the external service in response to analyzing the data that is communicated to and facilitates a corresponding action at least at one or more edge nodes of the private network. ### Claim 38 (depends on 37) The computer program product of claim 37, wherein the data comprises a data stream. ### Claim 39 (depends on 37) The computer program product of claim 37, wherein the data comprises sampled data. ### Claim 40 (depends on 37) The computer program product of claim 37, wherein the data comprises flow data. ### Claim 41 (depends on 37) The computer program product of claim 37, wherein the external service provides network and security operations for the private network. ### Claim 42 (depends on 37) The computer program product of claim 37, wherein the external service facilitates managing and optimizing performance of the private network. ### Claim 43 (depends on 37) The computer program product of claim 37, wherein the external service facilitates defending the private network from threats and attacks. ### Claim 44 (depends on 37) The computer program product of claim 37, wherein the external service comprises a distributed intrusion detection and prevention system. ### Claim 45 (depends on 37) The computer program product of claim 37, further comprising computer instructions for indexing the received data for searchability at the external service. ### Claim 46 (depends on 37) The computer program product of claim 37, further comprising computer instructions for tagging the received data with metadata at the external service. ### Claim 47 (depends on 37) The computer program product of claim 37, further comprising computer instructions for storing the received data at the external service. ### Claim 48 (depends on 37) The computer program product of claim 37, wherein analyzing the received data at the external service comprises detecting a network performance or security event. ### Claim 49 (depends on 37) The computer program product of claim 37, wherein the output is generated by a rules engine of the external service that is configured to map a detected event to the action. ### Claim 50 (depends on 37) The computer program product of claim 37, wherein the corresponding action facilitated by the output generated by the external service comprises modifying routing. ### Claim 51 (depends on 37) The computer program product of claim 37, wherein the corresponding action facilitated by the output generated by the external service comprises remediating a detected security event. ### Claim 52 (depends on 37) The computer program product of claim 37, wherein the corresponding action facilitated by the output generated by the external service modifies network operation. ### Claim 53 (depends on 37) The computer program product of claim 37, wherein the corresponding action facilitated by the output generated by the external service modifies security policy. ### Claim 54 (depends on 37) The computer program product of claim 37, further comprising computer instructions for providing a portal to the external service that is accessible to an operator of the private network.