XDR Device Identifier Mapping for Cross-Source Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
XDR systems face challenges in correlating security events and identifying common assets across different data sources due to the use of disparate local device identifiers by various monitoring tools, hindering effective cross-domain data analytics and incident response.
Innovation Solution
A method for mapping local device identifiers to a common global identifier within an XDR system, using a tracking component that analyzes associations and assigns global identifiers based on proximity in an association graph, with a hybrid data storage approach for efficient translation and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different monitoring tools use their own local device identifiers, then each tool can independently track devices, but the XDR system cannot correlate events across different data sources
Solution Approach 1:
The patent introduces a tracking component as an intermediary that maintains a mapping between local device identifiers from different monitoring tools and a unified global identifier. This mediator translates and correlates events across heterogeneous data sources, enabling accurate event correlation without requiring changes to the existing monitoring tools.
2Reliability
If the XDR system implements comprehensive asset tracking across all data sources, then it can detect multi-stage attacks, but the computational overhead and storage requirements increase
Solution Approach 1:
The tracking component performs preliminary actions by pre-establishing and maintaining device identifier mappings in a dedicated data structure. This allows the system to quickly correlate events during threat detection without performing complex computations at query time, reducing computational overhead while maintaining comprehensive tracking capabilities.
3Measurement precision
If the system stores detailed mapping data for all devices, then it can provide accurate translation and retrieval, but the storage requirements and data management complexity increase
Solution Approach 1:
The patent segments the identifier mapping data into a dedicated tracking data structure that is separate from the main security event data. This segmentation allows efficient storage and management of mapping information, enabling accurate translation and retrieval without overwhelming the overall storage system.
Data Source
AI summary
This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.