XDR Asset Tracking With Global Identifier Mapping

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

XDR systems face challenges in correlating security events and identifying common assets across different data sources due to the use of disparate local device identifiers by various monitoring tools, hindering effective cross-domain data analytics and incident response.

Innovation Solution

A method for mapping local device identifiers to a common global identifier within an XDR system, utilizing a tracking component that employs a graph-based recursive set expansion technique and a two-tier data storage approach to ensure efficient and accurate asset tracking across heterogeneous security data feeds.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If different monitoring tools use their own local device identifiers, then each tool can independently track assets, but the XDR system cannot correlate events across different data sources

Engineering Contradiction:

Improveasset tracking accuracyVSAvoididentifier mapping complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a tracking component as an intermediary that maintains a mapping between local device identifiers from different monitoring tools and a unified global identifier. This mediator enables correlation of events across heterogeneous data sources without requiring changes to the existing monitoring tools, thereby maintaining asset tracking accuracy while managing identifier complexity centrally.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The tracking component provides universal identifier translation capabilities that work across multiple monitoring tools and data sources. By creating a unified global identifier system that can translate to and from various local identifier formats, the system achieves multi-functional compatibility without sacrificing the specificity needed for accurate asset tracking in each domain.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Measurement precision

If the system waits for complete data batches to determine device identifiers, then accuracy improves, but processing time increases

Engineering Contradiction:

Improvedevice identifier accuracyVSAvoididentifier determination delay

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by maintaining a mapping of local identifiers to global identifiers in advance. When events arrive from monitoring tools, the tracking component can quickly resolve identifiers using pre-established mappings rather than waiting to compile complete data batches, thereby reducing delay while maintaining accuracy through the pre-computed identifier relationships.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The identifier determination process is made dynamic by allowing the system to adapt its waiting behavior based on data arrival patterns. The tracking component can determine identifiers as soon as sufficient information is available rather than waiting for fixed batch intervals, enabling the system to balance accuracy and timing requirements dynamically based on actual data flow conditions.

Inventive Principle:

Principle #15Dynamics

3Reliability

If the system processes all monitoring data synchronously, then data consistency is maintained, but processing throughput decreases

Engineering Contradiction:

Improvedata consistencyVSAvoiddata processing throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the data processing workflow into independent asynchronous components: monitoring tools generate events independently, the tracking component processes identifier mappings independently, and event correlation occurs independently. This segmentation allows each component to operate at its own pace without blocking others, maintaining data consistency through the identifier mapping mechanism while significantly improving overall processing throughput through parallel execution.

Inventive Principle:

Principle #1Segmentation

4Adaptability or versatility

If the system implements comprehensive asset tracking across all data sources, then cross-domain analytics capability improves, but system complexity increases

Engineering Contradiction:

Improvecross-domain analytics capabilityVSAvoidtracking system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The tracking component serves as an intermediary layer that handles the complexity of cross-domain asset tracking centrally. By maintaining the identifier mapping and translation logic in this dedicated mediator, the system achieves comprehensive cross-domain analytics capability without distributing complexity across all monitoring tools and processing components, thereby enabling versatility while managing complexity in a localized manner.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12531892B2Asynchronous data processing in extended detection and response systems

Publication Date: 2026.01.20 CISCO TECHNOLOGY INC

AI summary

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.