The NDR appliance can integrate, or pair, with Critical Asset Discovery (CAD) to discover all the assets in the network and classify them by their role and category. CAD is the mechanism that identifies each device in the network and mark them as critical or potential critical based on some defined criteria. In addition to this, devices are categorised to identify devices as pc, mobile, and server.
Critical Asset Discovery parses each incoming record and extracts data from it. The data is aggregated in terms of number of records received, number of clients, number of targets, number of event types and so on. This data is stored in postgres database every 30 seconds.
Each asset in the network consists an entry in the DB table for source or destination. For sources, target field is updated with the destination it is communicating with, along with fields total_records_out, event_count_out, user_agents for http data, client_mac for data extracted from DHCP data or flow data containing ethernet address. For destinations, client field is updated with sources it is communicating with, along with total_records_in, event_count_in, and other fields. A maximum of seven clients and targets can be stored. If in case there are more clients to be added, the oldest entries are removed.
After service restart, data gets added for new records and updated for existing records. This data is stored in local memory and read in the same format. As and when the data is collected, it gets aggregated as per asset and pushed into the database. A memory map is created for each asset that stores the data for each service running on the asset separately in a structure format used for critical asset identification and device categorization. The map gets updated with each record received. The services within each asset are identified uniquely based on a combination of asset_ip-asset_port-protocol. The TotalRecords and clients field within each service are stored in the form of an array every 2 min. The critical asset identification runs every 2 minutes along with device categorization.
Important
For more information on the Asset Discovery APIs, refer to the Network Detection and Response API Guide document.