Temporal resolution of an entity
A system, method, and computer-readable medium for resolving an identity of an entity, comprising parsing entity identifier information associated with the entity to provide an entity identifier element, the entity identifier information comprising temporal information; classifying the entity identifier element to provide a classified entity identifier element; normalizing the classified entity identifier element to provide a classified and normalized entity identifier element; and, associating the classified and normalized entity identifier element and the temporal information with the entity to resolve the identity of the entity at a particular point in time.
1. A computer-implementable method for resolving an identity of an entity, comprising:
receiving a stream of events from a protected endpoint, the stream of events comprising a plurality of events, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent requiring the endpoint device to comply with particular criteria before being granted access to network resources, the protected endpoint providing a policy-based approach to network security;
parsing entity identifier information associated with the entity from the stream of events to provide an entity identifier element, the entity identifier information comprising temporal information;
classifying the entity identifier element by type to provide a classified entity identifier element, the classified entity identifier element comprising an entity identifier element type, the entity identifier element type providing a representation of a particular attribute associated with the entity identifier element;
normalizing the classified entity identifier element to provide a classified and normalized entity identifier element, the classified and normalized entity identifier element comprising a type-dependent normalized entity identifier element;
associating the classified and normalized entity identifier element and the temporal information with the entity in real time to resolve the identity of the entity at a particular point in time, the associating determining whether the classified and normalized entity identifier element matches a known entity identifier element type for the particular point in time in a repository of resolved entity identifier data;
storing the resolved identity of the entity in the repository of resolved entity identifier data;
performing a security analysis operation, the security analysis operation using the resolved identity of the entity at the particular point in time to assess a risk associated with the entity; and
responding with an associated response based on the accessed risk associated with the entity.
2. The computer-implementable method of claim 1 , wherein:
the temporal information is associated with an event of the plurality of events associated with a particular point in time.
3. The computer-implementable method of claim 1 , wherein:
the temporal information comprises temporal event information, the temporal event information being associated with a particular event of the plurality of events.
4. The computer-implementable method of claim 3 , wherein:
the temporal event information comprises content, the content comprising at least one of text, unstructured data, structured data, a graphical image, a photograph, an audio recording, and a video recording.
5. The computer-implementable method of claim 4 , wherein:
the temporal event information comprises metadata associated with the content, the metadata comprising a temporal event attribute for the content.
6. The computer-implementable method of claim 1 , wherein:
the normalizing provides an implicit identifier pair associated with the normalized entity identifier element.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code for resolving an identity of an entity, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving a stream of events from a protected endpoint, the stream of events comprising a plurality of events, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent requiring the endpoint device to comply with particular criteria before being granted access to network resources, the protected endpoint providing a policy-based approach to network security;
parsing entity identifier information associated with the entity from the stream of events to provide an entity identifier element, the entity identifier information comprising temporal information;
classifying the entity identifier element by type to provide a classified entity identifier element, the classified entity identifier element comprising an entity identifier element type, the entity identifier element type providing a representation of a particular attribute associated with the entity identifier element;
normalizing the classified entity identifier element to provide a classified and normalized entity identifier element, the classified and normalized entity identifier element comprising a type-dependent normalized entity identifier element;
associating the classified and normalized entity identifier element and the temporal information with the entity in real time to resolve the identity of the entity at a particular point in time, the associating determining whether the classified and normalized entity identifier element matches a known entity identifier element type for the particular point in time in a repository of resolved entity identifier data;
storing the resolved identity of the entity in the repository of resolved entity identifier data;
performing a security analysis operation, the security analysis operation using the resolved identity of the entity at the particular point in time to assess a risk associated with the entity; and,
responding with an associated response based on the accessed risk associated with the entity.
8. The system of claim 7 , wherein:
the temporal information is associated with an event of the plurality of events associated with a particular point in time.
9. The system of claim 7 , wherein:
the temporal information comprises temporal event information, the temporal event information being associated with a particular event of the plurality of events.
10. The system of claim 9 , wherein:
the temporal event information comprises content, the content comprising at least one of text, unstructured data, structured data, a graphical image, a photograph, an audio recording, and a video recording.
11. The system of claim 10 , wherein:
the temporal event information comprises metadata associated with the content, the metadata comprising a temporal event attribute for the content.
12. The system of claim 7 , wherein:
the normalizing provides an implicit identifier pair associated with the normalized entity identifier element.
13. A non-transitory, computer-readable storage medium embodying computer program code for resolving an identity of an entity, the computer program code comprising computer executable instructions configured for:
receiving a stream of events from a protected endpoint, the stream of events comprising a plurality of events, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent requiring the endpoint device to comply with particular criteria before being granted access to network resources, the protected endpoint providing a policy-based approach to network security;
parsing entity identifier information associated with the from the stream of events entity to provide an entity identifier element, the entity identifier information comprising temporal information;
classifying the entity identifier element by type to provide a classified entity identifier element, the classified entity identifier element comprising an entity identifier element type, the entity identifier element type providing a representation of a particular attribute associated with the entity identifier element;
normalizing the classified entity identifier element to provide a classified and normalized entity identifier element, the classified and normalized entity identifier element comprising a type-dependent normalized entity identifier element;
associating the classified and normalized entity identifier element and the temporal information with the entity in real time to resolve the identity of the entity at a particular point in time, the associating determining whether the classified and normalized entity identifier element matches a known entity identifier element type for the particular point in time in a repository of resolved entity identifier data;
storing the resolved identity of the entity in the repository of resolved entity identifier data;
performing a security analysis operation, the security analysis operation using the resolved identity of the entity at the particular point in time to assess a risk associated with the entity; and,
responding with an associated response based on the accessed risk associated with the entity.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the temporal information is associated with an event of the plurality of events associated with a particular point in time.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the temporal information comprises temporal event information, the temporal event information being associated with a particular event of the plurality of events.
16. The non-transitory, computer-readable storage medium of claim 15 , wherein:
the temporal event information comprises content, the content comprising at least one of text, unstructured data, structured data, a graphical image, a photograph, an audio recording, and a video recording.
17. The non-transitory, computer-readable storage medium of claim 16 , wherein:
the temporal event information comprises metadata associated with the content, the metadata comprising a temporal event attribute for the content.
18. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the normalizing provides an implicit identifier pair associated with the normalized entity identifier element.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.