Extending AI-Native Operations Across the Full Stack with HPE

Ram Krishnan and a colleague from HPE Networking’s product management team show the first integration of EdgeConnect SD-WAN into the Mist cloud. The session demonstrates onboarding, full-stack troubleshooting that correlates wireless, wired, WAN, and security data, and Marvis agentic analysis of intrusion events, followed by a preview of EdgeConnect monitoring coming to Aruba Central. Krishnan, a product manager, co-presented the session at Security Field Day 16 along with Nick Norman.

Mist began as a wireless management platform and later added wired devices; EdgeConnect is the next addition. To onboard, an administrator enters a code from the Mist tenant into the EdgeConnect orchestrator, selects the gateways, and enables the integration. The demo then followed a reported problem at a Kansas City lab site. Marvis actions showed VPN-down events, and service level expectations put wireless at 94 percent, wired at 96 percent, and WAN at 79 percent. Within the WAN, application health was the weakest at 42 percent, and nearly all of that came from application disconnects affecting Okta, Dropbox, G Suite, and YouTube. Impacted clients from the wireless and wired sides appeared in the same view. The site’s intrusion detection events, 99 minor and one major, had been ignored as recommended and did not affect users. Across the whole organization, a Marvis agentic query turned the raw signatures into plain language. It reported roughly 14,000 events in 24 hours from a single host that had been beaconing DNS queries for a week, and it recommended isolating the device immediately.

The presenters said one-click quarantine is not available yet, and the Mist integration currently covers day-two monitoring, with configuration coming later. A delegate pressed for links from Mist back to the orchestrator so an admin could act on a recommendation such as updating an IDP policy without switching tabs, and the team acknowledged the request. Similar EdgeConnect site health, device health, network, event, and alerting views are expected in Aruba Central by mid-next year. Krishnan concluded that correlating LAN, WAN, and security in one view lets operators replace finger-pointing between teams with evidence that shows exactly where to troubleshoot.