# US 2017/0257281 A1 · System Administration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0257281 A1 - Document ID: US20170257281A1 - Status: Published application - Kind: A1 - Application number: 15/602,044 - Filed: 2017-05-22 - Published: 2017-09-07 - Earliest claimed: 2012-03-14 - Assignees: Panorama9, Inc. - Applicants: Panorama9, Inc. - Inventors: Allan Thorvaldsen; Diego d'Ambra - Web page: https://patentgrep.com/patent/US20170257281A1 ## CPC - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 41/0856: {by backing up or archiving configuration information} - H04L 41/20: {Network management software packages} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 41/06: Management of faults, events, alarms or notifications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique for improving system administration involves implementing system administration agent programs on a plurality of devices in an administered network. A deployment agent deploys the system administration agent program or a portion thereof to suitable devices when they are detected. System monitoring agents monitor the administered network to generate data. A reporting engine sends agent reports including the generated data to a system administration server. The system administration server facilitates administration of the administered network in real time. ## Claims ### Claim 1 A method comprising: sending a request for a network device list including a list of addresses of devices in an administered network; receiving the network device list in response to the request for the network device including the list of address of devices in the administered network; determining whether a first device of the devices in the administered network based on the list of addresses of devices in the administered network has a locally installed system administrator agent program; determining whether the first device is suitable for having the system administrator agent program locally installed if it is determined the system administrator agent program is absent from the first device; if it is determined that the first device is suitable for having the system administrator agent program locally installed, instructing a second device coupled to the first device through the administered network to provide the system administrator agent program to the first device; updating the network device list to indicate the first device has the system administrator agent program locally installed; monitoring the administrator network at least in part by monitoring the first device accessing resources of the administered network through the system administrator agent program. ### Claim 2 (depends on 1) The method of claim 1, wherein the system administrator agent program locally installed on the first device is configured to monitor the first device accessing the resources of the administered network according to a simple network management protocol. ### Claim 3 (depends on 1) The method of claim 1, wherein the system administrator agent program locally installed on the first device is configured to monitor the first device accessing the resources of the administered network by performing deep packet inspection on data packets transmitted either or both to and from the first device as part of the first device accessing the resources of the administered network. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; identifying an event from the agent report; identifying assets of the administered network; determining whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generating an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, from system administration agent programs locally installed at the devices in the administered network including the system administration agent program locally installed at the first device, agent reports indicating a plurality of resources of the administered network accessed by the devices including the resources of the administered network accessed by the first device; identifying events from the agent reports; identifying assets of the administered network; determining whether to generate an issue report based on the events identified from the agent reports and the identified assets of the administered network; generating an issue report if it is determined to generate an issue report based on the events identified from the agent reports and the identified assets of the administered network. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; identifying an event from the agent report; identifying assets of the administered network; determining whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network by an expert subsystem associated with a specific area of determining whether to generate issue reports based on events; generating an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; identifying an event from the agent report; identifying assets of the administered network; determining whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generating an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; incorporating the issue report into a relevant portion of a system administrator dashboard display. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; identifying an event from the agent report; identifying assets of the administered network; determining whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generating an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; incorporating the issue report into a relevant portion of a system administrator dashboard display including a compliance dashboard display configured to display device compliance categorized by one or a combination of behavior, unapproved software, software license, and service-level agreement. ### Claim 9 (depends on 1) The method of claim 1, further comprising: receiving, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; identifying an event from the agent report; identifying assets of the administered network; determining whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generating an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; incorporating the issue report into a relevant portion of a system administrator dashboard display including a compliance dashboard display configured to display identified issues in the issue report with a category corresponding to each issue of the identified issues. ### Claim 10 (depends on 1) The method of claim 1, further comprising determining whether the first device is in the administered network by comparing an IP address of the first device to a valid range of IP addresses for the administered network. ### Claim 11 A system comprising: a system administration engine configured to: send a request for a network device list including a list of addresses of devices in an administered network; receive the network device list in response to the request for the network device including the list of address of devices in the administered network; an ARP engine configured to determine whether a first device of the devices in the administered network based on the list of addresses of devices in the administered network has a locally installed system administrator agent program; a deployment engine configured to: determine whether the first device is suitable for having the system administrator agent program locally installed if it is determined the system administrator agent program is absent from the first device; instruct a second device coupled to the first device through the administered network to provide the system administrator agent program to the first device, if it is determined that the first device is suitable for having the system administrator agent program locally installed; the ARP engine further configured to update the network device list to indicate the first device has the system administrator agent program locally installed; a system monitoring engine configured to monitor the administrator network at least in part by monitoring the first device accessing resources of the administered network through the system administrator agent program. ### Claim 12 (depends on 11) The system of claim 11, wherein the system administrator agent program locally installed on the first device is configured to monitor the first device accessing the resources of the administered network according to a simple network management protocol. ### Claim 13 (depends on 11) The system of claim 11, wherein the system administrator agent program locally installed on the first device is configured to monitor the first device accessing the resources of the administered network by performing deep packet inspection on data packets transmitted either or both to and from the first device as part of the first device accessing the resources of the administered network. ### Claim 14 (depends on 11) The system of claim 11, further comprising: an agent interface engine configured to receive, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; an event bus configured to identify an event from the agent report; an expert engine configured to: identify assets of the administered network; determine whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generate an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network. ### Claim 15 (depends on 11) The system of claim 11, further comprising: an agent interface engine configured to receive, from system administration agent programs locally installed at the devices in the administered network including the system administration agent program locally installed at the first device, agent reports indicating a plurality of resources of the administered network accessed by the devices including the resources of the administered network accessed by the first device; an event bus configured to identify events from the agent reports; an expert engine configured to: identify assets of the administered network; determine whether to generate an issue report based on the events identified from the agent reports and the identified assets of the administered network; generate an issue report if it is determined to generate an issue report based on the events identified from the agent reports and the identified assets of the administered network. ### Claim 16 (depends on 11) The system of claim 11, further comprising: an agent interface engine configured to receive, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; an event bus configured to identify an event from the agent report; an expert engine with an expert subsystem associated with a specific area of determining whether to generate issue reports based on events configured to: identify assets of the administered network; determine whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generate an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network. ### Claim 17 (depends on 11) The system of claim 11, further comprising: an agent interface engine configured to receive, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; an event bus configured to identify an event from the agent report; an expert engine configured to: identify assets of the administered network; determine whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generate an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; a dashboard service engine configured to incorporate the issue report into a relevant portion of a system administrator dashboard display. ### Claim 18 (depends on 11) The system of claim 11, further comprising: an agent interface engine configured to receive, from the system administration agent program locally installed at the first device, an agent report indicating the resources of the administered network accessed by the first device; an event bus configured to identify an event from the agent report; an expert engine configured to: identify assets of the administered network; determine whether to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; generate an issue report if it is determined to generate an issue report based on the event identified from the agent report and the identified assets of the administered network; a dashboard service engine configured to incorporate the issue report into a relevant portion of a system administrator dashboard display including a compliance dashboard display configured to display device compliance categorized by one or a combination of behavior, unapproved software, software license, and service-level agreement. ### Claim 19 (depends on 11) The system of claim 11, wherein the system administration engine is further configured to determine whether the first device is in the administered network by comparing an IP address of the first device to a valid range of IP addresses for the administered network. ### Claim 20 A system comprising: means for sending a request for a network device list including a list of addresses of devices in an administered network; means for receiving the network device list in response to the request for the network device including the list of address of devices in the administered network; means for determining whether a first device of the devices in the administered network based on the list of addresses of devices in the administered network has a locally installed system administrator agent program; means for determining whether the first device is suitable for having the system administrator agent program locally installed if it is determined the system administrator agent program is absent from the first device; means for instructing a second device coupled to the first device through the administered network to provide the system administrator agent program to the first device, if it is determined that the first device is suitable for having the system administrator agent program locally installed; means for updating the network device list to indicate the first device has the system administrator agent program locally installed; means for monitoring the administrator network at least in part by monitoring the first device accessing resources of the administered network through the system administrator agent program.