Asset inventory reconciliation services for use in asset management architectures
Disclosed below are representative embodiments of methods, apparatus, and systems for managing, monitoring, controlling, and/or classifying assets in an information technology (“IT”) environment. Certain embodiments leverage bath services oriented architecture concepts and event mechanisms to create a platform with which additional controls can easily integrate.
1. A system, comprising:
one or more processors; and
one or more computer-readable storage media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively perform operations comprising:
receiving asset information from a plurality of sources in an IT environment, each received asset information describing a corresponding asset in the IT environment;
comparing a first one of the received asset information to previously stored asset information for a plurality of pre-existing assets, wherein each of the pre-existing assets has a corresponding unique identifier that was assigned automatically by the system upon discovery of the respective asset by the system, and wherein the previously stored asset information is stored in a database with the corresponding unique identifiers;
using one or more reconciliation rules applied by the system, determining that the first received asset information is not reconcilable with any of the previously stored asset information and consequently assigning a new unique identifier to the asset corresponding to the first received asset information and storing the first received asset information with the first new unique identifier in the database; and
using the one or more reconciliation rules applied by the system, comparing second received asset information to the previously stored asset information and determining that the second received asset information is reconcilable with previously stored asset information associated with a second unique identifier and consequently merging the second received asset information with the previously stored asset information associated with the second unique identifier,
wherein the merging applies a union operation to synthetic IDs that have been assigned to the respective asset by different source systems monitoring the respective asset, the union operation allowing the respective asset to be correctly mapped back to the different source systems monitoring the respective asset, the union operation further eliminating any duplicative information in the database common to the second received asset information and the previously stored asset information associated with the second unique identifier while maintaining at least the distinct respective synthetic IDs for the second received asset information and the previously stored asset information;
providing the merged asset information with the second unique identifier in the database for the respective asset for a security control operation; and
utilizing the synthetic IDs of the merged asset information to map the asset back to each of the different source systems monitoring the asset.
2. The system of claim 1 , wherein the previously stored asset information includes an IP address and a hostname for the corresponding asset.
3. The system of claim 1 , wherein the storage media store additional computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively perform additional operations comprising:
sending one or more of the asset information stored in the database to a reporting tool that generates reports describing security controls in the IT environment.
4. The system of claim 1 , wherein the asset information stored in the database includes tag data associated with the assets, the tag data comprising one or more tags, each tag being configured for association with multiple assets in the IT environment.
5. The system of claim 1 , wherein the different source systems monitoring the respective asset include:
a compliance and configuration control (CCC) tool that detects, analyzes, and reports on change activity in assets in the IT environment; and
a security control (SC) tool that measures and manages security risks to assets in the IT environment.
6. The system of claim 5 , wherein at least one asset in a first set of assets discovered in the IT environment by the CCC tool is different from that in a second set of assets discovered in the IT environment by the SC tool.
7. The system of claim 1 , wherein the first received asset information includes a media access control (MAC) address or a hostname for the corresponding asset, and the comparing is based on the MAC address or the hostname.
8. The system of claim 1 , wherein the receiving asset information is via an application program interface (API) employing a representational state transfer (REST) standard.
9. The system of claim 1 , wherein the storage media store additional computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively perform additional operations comprising:
prior to the comparing, performing one or more filtering operations on the received asset information.
10. The system of claim 9 , wherein the one or more filtering operations comprises an attribute filtering operation that removes data from one or more of the received asset information.
11. The system of claim 10 , wherein the removed data comprises a loopback IP address.
12. The system of claim 9 , wherein the one or more filtering operations comprises an asset filtering operation that rejects one or more assets and corresponding received asset information.
13. The system of claim 12 , wherein the asset filtering operation is based on hostname convention or a subnet in an IP address of the received asset information.
14. A system, comprising:
one or more processors; and
one or more computer-readable storage media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively perform operations comprising:
receiving asset information from a plurality of sources in an IT environment, the received asset information being information collected from a first asset in the IT environment;
comparing the received asset information for the first asset to previously-stored asset information for a plurality of assets;
using one or more reconciliation rules: (a) determining that the received asset information for the first asset is reconcilable with previously-stored asset information for a second asset, the second asset having a different unique identifier than the first asset; (b) merging the first received asset information with the previously-stored asset information, the merging comprising retaining common information, adding new information from the received asset information, and eliminating outdated information from the previously-stored asset information, and (c) applying a union operation to synthetic IDs that have been assigned to the first asset and the second asset, the union operation further eliminating any duplicative information in the database common to the second received asset information and the previously stored asset information associated with the second unique identifier while maintaining at least the distinct respective synthetic IDs for the second received asset information and the previously stored asset information;
providing the merged asset information as being for the second asset having the different unique identifier for a security control operation;
utilizing the synthetic IDs of the merged asset information to map the asset back to each of the different source systems monitoring the asset.
15. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:
receiving asset information from a plurality of sources in an IT environment, the received asset information being information collected from a first asset in the IT environment;
comparing the received asset information for the first asset to previously-stored asset information for a plurality of assets;
using one or more reconciliation rules: (a) determining that the received asset information for the first asset is reconcilable with previously-stored asset information for a second asset, the second asset having a different unique identifier than the first asset; (b) merging the first received asset information with the previously-stored asset information, the merging comprising retaining common information, adding new information from the received asset information, and eliminating outdated information from the previously-stored asset information, and (c) applying a union operation to synthetic IDs that have been assigned to the first asset and the second asset, the union operation allowing the first and second assets to be correctly mapped back to different sources monitoring the first and second assets, respectively, the union operation further eliminating any duplicative information in the database common to the second received asset information and the previously stored asset information associated with the second unique identifier while maintaining at least the distinct respective synthetic IDs for the second received asset information and the previously stored asset information;
providing the merged asset information as being for the second asset having the different unique identifier for a security control operation;
utilizing the synthetic IDs of the merged asset information to map the asset back to each of the different source systems monitoring the asset.