WGU E026 TASK 1
AI-Enabled Hybrid Network
Automation and Security Design
Predictive maintenance | Anomaly detection | Alert classification
MITRE ATT&CK; mapping | Palo Alto Networks security controls | SOAR response
Student: [Replace with your name]
Student ID: [Replace with your ID]
Date: [Replace with submission date]
Prepared for the E026 performance assessment
2026 Edition
, Submission Readiness Notice
Before submitting
Replace the name, student ID, and date on the cover. Compare every heading against the task rubric currently visible
in your WGU portal. Add any screenshots, prompt-history exports, or GNS3 evidence explicitly required by your
course version. Do not present an AI-generated diagram as a completed lab unless you personally built and tested it.
Purpose and Scope
This design addresses a mid-sized organization that must expand its on-premises network into a secured cloud environment
while reducing operational bottlenecks and improving cyber defense. The proposed architecture combines segmented hybrid
networking, centralized telemetry, machine-learning analytics, and automated response. The proof of concept is intentionally
vendor-specific where enforcement behavior matters: Palo Alto Networks PA-Series next-generation firewalls and Threat
Prevention provide the network prevention control, while a cloud-hosted SIEM/SOAR platform coordinates analytics and
response.
Design Objectives
• Availability: forecast device degradation early enough to schedule maintenance before a service interruption.
• Detection: identify novel or low-frequency behavior without relying exclusively on known signatures.
• Triage: classify alerts consistently and attach severity, confidence, owner, and recommended action.
• Containment: execute low-risk response actions automatically and require analyst approval for disruptive actions.
• Hybrid security: extend segmentation, identity, logging, encryption, and least privilege across on-premises and cloud
boundaries.
Assumptions
ID Design assumption
AS-1 The enterprise owns RFC1918 address space 10.10.0.0/16; the cloud environment uses nonoverlapping 10.20.0.0/16.
AS-2 Two IPsec tunnels provide resilient site-to-site connectivity; BGP exchanges only approved routes.
AS-3 Devices export syslog, SNMP metrics and traps, interface counters, authentication events, and NetFlow/IPFIX.
AS-4 The organization has an identity provider with MFA and an IT service-management platform for tickets and change control.
AS-5 All automated blocking actions are logged, time bounded, reversible, and tested in a staging environment first.
WGU E026 Task 1 | AI for IT Automation and Security Page 2 of 16
, A. AI Techniques and Model Selection
A1. Predictive Analytics for Device Failure
Selected technique: multivariate Long Short-Term Memory (LSTM) forecasting with a gradient-boosted tree
baseline. An LSTM is appropriate because device health is sequential: a single temperature or error counter may be
harmless, while a sustained rise, repeated oscillation, or interaction among temperature, CPU load, memory pressure,
interface errors, fan speed, and power-supply alarms can indicate degradation. LSTM cells retain relevant temporal context
and model nonlinear relationships. A gradient-boosted baseline provides a transparent comparison and a fallback if the
history is too limited for a neural model.
Element Implementation
Target Probability of failure within the next 24 hours and 7 days; estimated remaining useful life when sufficient labeled history
exists.
Features CPU and memory utilization; inlet temperature; fan RPM; voltage; interface CRC/input errors; packet drops; link flaps;
reboot count; mean time between alarms; firmware age; device role and model.
Windowing Aggregate raw measurements into 5-minute intervals; use rolling 24-hour sequences. Preserve maxima, slopes, volatility,
and missingness indicators.
Labels Confirmed hardware incident, RMA, unscheduled reboot, interface failure, or emergency replacement recorded in ITSM.
Exclude planned maintenance.
Validation Time-ordered train/validation/test split to prevent future leakage. Compare LSTM with persistence and boosted-tree
baselines.
Metrics PR-AUC and recall for rare failures; false alarms per 100 devices/week; Brier score for calibration; median warning lead
time.
Action At calibrated risk >=0.80, create a predictive-maintenance ticket and collect diagnostics. At >=0.92 plus corroborating
telemetry, request an approved maintenance window.
Training and governance
Telemetry is synchronized to UTC, deduplicated, normalized by device model, and checked for sensor drift. Class imbalance
is handled with cost-sensitive learning rather than random oversampling across time. The model registry records data
version, feature schema, hyperparameters, thresholds, owner, approval, and rollback artifact. Monthly drift checks compare
recent feature distributions and calibration with the validated baseline. Predictions never reboot or replace a device
automatically; they initiate diagnostics and a controlled maintenance workflow.
Why not simple linear regression?
Linear regression assumes a relatively simple relationship and is poorly matched to nonlinear temporal interactions and rare
binary events. It remains useful for narrow trend checks, but it is not the primary failure-risk model.
WGU E026 Task 1 | AI for IT Automation and Security Page 3 of 16
AI-Enabled Hybrid Network
Automation and Security Design
Predictive maintenance | Anomaly detection | Alert classification
MITRE ATT&CK; mapping | Palo Alto Networks security controls | SOAR response
Student: [Replace with your name]
Student ID: [Replace with your ID]
Date: [Replace with submission date]
Prepared for the E026 performance assessment
2026 Edition
, Submission Readiness Notice
Before submitting
Replace the name, student ID, and date on the cover. Compare every heading against the task rubric currently visible
in your WGU portal. Add any screenshots, prompt-history exports, or GNS3 evidence explicitly required by your
course version. Do not present an AI-generated diagram as a completed lab unless you personally built and tested it.
Purpose and Scope
This design addresses a mid-sized organization that must expand its on-premises network into a secured cloud environment
while reducing operational bottlenecks and improving cyber defense. The proposed architecture combines segmented hybrid
networking, centralized telemetry, machine-learning analytics, and automated response. The proof of concept is intentionally
vendor-specific where enforcement behavior matters: Palo Alto Networks PA-Series next-generation firewalls and Threat
Prevention provide the network prevention control, while a cloud-hosted SIEM/SOAR platform coordinates analytics and
response.
Design Objectives
• Availability: forecast device degradation early enough to schedule maintenance before a service interruption.
• Detection: identify novel or low-frequency behavior without relying exclusively on known signatures.
• Triage: classify alerts consistently and attach severity, confidence, owner, and recommended action.
• Containment: execute low-risk response actions automatically and require analyst approval for disruptive actions.
• Hybrid security: extend segmentation, identity, logging, encryption, and least privilege across on-premises and cloud
boundaries.
Assumptions
ID Design assumption
AS-1 The enterprise owns RFC1918 address space 10.10.0.0/16; the cloud environment uses nonoverlapping 10.20.0.0/16.
AS-2 Two IPsec tunnels provide resilient site-to-site connectivity; BGP exchanges only approved routes.
AS-3 Devices export syslog, SNMP metrics and traps, interface counters, authentication events, and NetFlow/IPFIX.
AS-4 The organization has an identity provider with MFA and an IT service-management platform for tickets and change control.
AS-5 All automated blocking actions are logged, time bounded, reversible, and tested in a staging environment first.
WGU E026 Task 1 | AI for IT Automation and Security Page 2 of 16
, A. AI Techniques and Model Selection
A1. Predictive Analytics for Device Failure
Selected technique: multivariate Long Short-Term Memory (LSTM) forecasting with a gradient-boosted tree
baseline. An LSTM is appropriate because device health is sequential: a single temperature or error counter may be
harmless, while a sustained rise, repeated oscillation, or interaction among temperature, CPU load, memory pressure,
interface errors, fan speed, and power-supply alarms can indicate degradation. LSTM cells retain relevant temporal context
and model nonlinear relationships. A gradient-boosted baseline provides a transparent comparison and a fallback if the
history is too limited for a neural model.
Element Implementation
Target Probability of failure within the next 24 hours and 7 days; estimated remaining useful life when sufficient labeled history
exists.
Features CPU and memory utilization; inlet temperature; fan RPM; voltage; interface CRC/input errors; packet drops; link flaps;
reboot count; mean time between alarms; firmware age; device role and model.
Windowing Aggregate raw measurements into 5-minute intervals; use rolling 24-hour sequences. Preserve maxima, slopes, volatility,
and missingness indicators.
Labels Confirmed hardware incident, RMA, unscheduled reboot, interface failure, or emergency replacement recorded in ITSM.
Exclude planned maintenance.
Validation Time-ordered train/validation/test split to prevent future leakage. Compare LSTM with persistence and boosted-tree
baselines.
Metrics PR-AUC and recall for rare failures; false alarms per 100 devices/week; Brier score for calibration; median warning lead
time.
Action At calibrated risk >=0.80, create a predictive-maintenance ticket and collect diagnostics. At >=0.92 plus corroborating
telemetry, request an approved maintenance window.
Training and governance
Telemetry is synchronized to UTC, deduplicated, normalized by device model, and checked for sensor drift. Class imbalance
is handled with cost-sensitive learning rather than random oversampling across time. The model registry records data
version, feature schema, hyperparameters, thresholds, owner, approval, and rollback artifact. Monthly drift checks compare
recent feature distributions and calibration with the validated baseline. Predictions never reboot or replace a device
automatically; they initiate diagnostics and a controlled maintenance workflow.
Why not simple linear regression?
Linear regression assumes a relatively simple relationship and is poorly matched to nonlinear temporal interactions and rare
binary events. It remains useful for narrow trend checks, but it is not the primary failure-risk model.
WGU E026 Task 1 | AI for IT Automation and Security Page 3 of 16
