sevco.io

Asset Telemetry

A conceptual overview of Asset Telemetry

Asset Telemetry is a set of events representing the state changes of identifiable, active source devices for any normalized device attribute that qualifies for change tracking.

📘

Italicized terms are important definitions of key system concepts. We recommend reading Unified Asset Inventory to understand these terms.

Asset Telemetry Overview

Asset Telemetry operates on identifiable, active source devices. It occurs after source device preprocessing, but before correlation.

After fetching a batch of source device observations, the identifiable, active source devices are sent to the telemetry engine. The telemetry engine compares the currently reported device with the previously reported device and, for every change on a change-tracked attribute, creates a change event.

Event Types

There are two categories of events currently reported:

  • Inventory Change Events: An event reported each time a device is either added to or removed from a given source.
  • Attribute Change Events: An event reported each time the value of a change-tracked attribute changes from the previous observation.

Inventory Change Events

For direct sources, there are two types of Inventory Change Events:

  • SourceMembershipAdd: This event is generated when a device is added to a source.
  • SourceMembershipRemove: This event is generated when a device is removed from a source.

These events are not generated for inferred sources that report device activity observations.

Attribute Change Events

There are two types of Attribute Change Events:

  • AttributeValueAdded: This event is generated when a new attribute value is observed.
  • AttributeValueRemoved: This event is generated when a previously seen attribute is removed.

Changes are not tracked on every attribute, but only a subset, including but not limited to:

Device AttributesUser Attributes
Active Directory DomainCreated Timestamp
Agent VersionEmails
Asset Classification CategoryFirst Name
Fully Qualified Domain NameFull Name
HostnamesGroups
IP AddressesLast Name
MAC AddressesNames
Operating SystemPhone Numbers
Roles
Status
Usernames

See your events page for a full list of tracked attributes. If there is an attribute you need tracked, please bring it to our attention!

Key Event Fields

FieldDescription
org_idThe ID of the Sevco Organization to which this event belongs.
sourceThe ID of the Source from which this event was generated.
config_idThe ID of the Source config this event was generated from (this is in cases where there are multiple live instances of the same source, like multiple Active Directory sources).
object_idThe ID of this object as reported by the source. For example, for Active Directory, this would be the machine SID.
object_versionA Sevco-internal version number of this object.
asset_typedevice
event_typeOne of the above event types; for example, SourceMembershipAdd.
event_timestampThe time this event was observed.
valid_until_timestampFor AttributeValueAdd events, the time when the attribute was removed.
attributeFor AttributeValueAdd or AttributeValueRemove events, the name of the attribute.
valueFor AttributeValueAdd or AttributeValueRemove events, the value of the attribute.

Event Examples

Attribute Value Add

{
    "org_id": "2719ac2e-8d52-4dac-958d-b928c79f0fdc",
    "source": "microsoft-ad",
    "config_id": "7bb1789a-5ec3-45ad-ae36-5ffe3afc9c1d",
    "object_id": "S-1-5-21-625934469-701448264-3900219089-55180",
    "object_version": "2021-03-17T16:47:37.854Z",
    "asset_type": "device",
    "event_type": "AttributeValueAdded",
    "event_time": "2021-03-17T16:47:37.854Z",
    "valid_until": null,
    "attribute": "hostnames",
    "value": "baylissbob"
}

Attribute Value Remove

Note that this event is from the same system as the above, but also includes the valid_until_timestamp referencing the previous events event_time.

{
    "org_id": "2719ac2e-8d52-4dac-958d-b928c79f0fdc",
    "source": "microsoft-ad",
    "config_id": "7bb1789a-5ec3-45ad-ae36-5ffe3afc9c1d",
    "object_id": "S-1-5-21-625934469-701448264-3900219089-55180",
    "object_version": "2021-03-17T16:47:37.854Z",
    "asset_type": "device",
    "event_type": "AttributeValueAdded",
    "event_time": "2021-03-17T16:47:37.854Z",
    "valid_until": "2021-03-18T16:47:37.854Z",
    "attribute": "hostnames",
    "value": "baylissbob"
}

Source Membership Add

{
    "org_id": "2719ac2e-8d52-4dac-958d-b928c79f0fdc",
    "source": "microsoft-ad",
    "config_id": "7bb1789a-5ec3-45ad-ae36-5ffe3afc9c1d",
    "object_id": "S-1-5-21-625934469-701448264-3900219089-55180",
    "object_version": "2021-03-17T16:47:37.854Z",
    "asset_type": "device",
    "event_type": "AttributeValueAdded",
    "event_time": "2021-03-17T16:47:37.854Z",
    "valid_until": "2021-03-18T16:47:37.854Z",
    "attribute": "hostnames",
    "value": "baylissbob"
}

Source Membership Remove

{
    "org_id": "2719ac2e-8d52-4dac-958d-b928c79f0fdc",
    "source": "microsoft-ad",
    "config_id": "7bb1789a-5ec3-45ad-ae36-5ffe3afc9c1d",
    "object_id": "S-1-5-21-625934469-701448264-3900219089-55180",
    "object_version": null,
    "asset_type": "device",
    "event_type": "SourceMembershipRemove",
    "event_time": "2021-03-17T16:47:37.854Z",
    "valid_until": null,
    "attribute": null,
    "value": null
}