A network monitoring, reporting and risk mitigation system collects events at a computing device within the local network to provide improved network security. The events are aggregated into alerts, which may be processed according to triggering definitions in order to create ARO (action, recommendations and observations) reports providing required or recommended actions to take or observations to a network administrator. The ARO reports may be processed by a remote server in order to generate contextual feedback for updating the triggering definitions.

Examples described herein include systems and methods for multi-tenant event sourcing and audit logging in a cloud-based computing infrastructure. In an example method, an event package can be received from a first microservice of an application. The event can describe any action performed within the computing infrastructure and can include various types of information. For example, it can include an event type, event ID, object type, object ID, and parent event ID. The event package can be associated with a tenant and only provided to tenant-approved recipients. The recipient can use the event package to automatically carry out steps to recreate and configure an object, or to determine the source of an event or failure within the system.

A system for secure transmission of business event notifications includes a memory, at least one processor, a service gateway configured to: publish application programming interfaces (APIs) for secure transmission of business event notifications, a notification server configured to: publish APIs for secure transmission of business event notifications corresponding to the APIs published by the service gateway, obtain a new business event to report, determine a partner to receive a notification of the new business event, transmit an event notification to the partner by way of the service gateway APIs, and register the event notification in a database.

A system for secure transmission of business event notifications includes a memory, at least one processor, a service gateway configured to: publish application programming interfaces (APIs) for secure transmission of business event notifications, a notification server configured to: publish APIs for secure transmission of business event notifications corresponding to the APIs published by the service gateway, obtain a new business event to report, determine a partner to receive a notification of the new business event, transmit an event notification to the partner by way of the service gateway APIs, and register the event notification in a database.

For data collection, apparatuses, methods, and systems are disclosed. One apparatus 800 includes a transceiver 825 that receives 905 a first request from a network analytics function to monitor and report occurrences of a first event. The apparatus 800 includes a processor 805 that identifies 910 a first type of network function in a mobile communication network that reports occurrence of the first event. The processor 805 sends 915 a second request to at least one network function of the first type to monitor and report occurrences of the first event and relays 920 reports of occurrence of the first event from the at least one network function to the network analytics function.

For data collection, apparatuses, methods, and systems are disclosed. One apparatus 800 includes a transceiver 825 that receives 905 a first request from a network analytics function to monitor and report occurrences of a first event. The apparatus 800 includes a processor 805 that identifies 910 a first type of network function in a mobile communication network that reports occurrence of the first event. The processor 805 sends 915 a second request to at least one network function of the first type to monitor and report occurrences of the first event and relays 920 reports of occurrence of the first event from the at least one network function to the network analytics function.

An example operation may include one or more of receiving a request associated with a key-value pair stored in a database, determining whether a state of the key-value pair has changed since a most recently received request, and in response to a determination that the state of the key-value pair has changed, generating a data block that includes a changed state of the key-value pair and adding the generated data block to a hash-linked chain of data blocks.

A method for providing data to a client computing device from an edge computing device is discussed herein. The method may include performing a network proximity check regarding the client computing device associated with a request for data captured by the wideband sensor. The method may further include determining, based on at least one proximity metric associated with the client computing device, a route for data responsive to the request for data associated with the network proximity check, where the route is one of a route including the cloud storage or a route that does not include the cloud storage. The method may also include receiving the request for data captured by the wideband sensor associated with the network proximity check. The method may also include transmitting the data responsive to the request for data captured by the wideband sensor associated with the network proximity check to the client computing device through the determined route.

A method for providing data to a client computing device from an edge computing device is discussed herein. The method may include performing a network proximity check regarding the client computing device associated with a request for data captured by the wideband sensor. The method may further include determining, based on at least one proximity metric associated with the client computing device, a route for data responsive to the request for data associated with the network proximity check, where the route is one of a route including the cloud storage or a route that does not include the cloud storage. The method may also include receiving the request for data captured by the wideband sensor associated with the network proximity check. The method may also include transmitting the data responsive to the request for data captured by the wideband sensor associated with the network proximity check to the client computing device through the determined route.

Temporarily suppressing and/or disabling notifications to a client device of events detected by a security device monitoring an environment. The notifications may be disabled and/or suppressed based upon a request from a user of the client device, or when the client device is nearby the security device. The user may request that notifications are suppressed for a definable suppression duration, wherein a timer is started to run for the suppression duration, and notifications are suppressed while the timer is running. When the client device is nearby the security device, suppression of the notifications for other users may be defined by a user-configurable table. A notification from a security device may include a suppress button to suppress notifications from that security device for a suppression period.