Product Capability · E-ITDR
Asset identity and
telemetry management
The other four capabilities all rest on one premise: that a host stays the same asset along the timeline, and that you know which data was never collected.
Why It Breaks
Identify assets by hostname and IP, and the ledger eventually falls apart
This is not a data-hygiene problem. Once an asset splits on the timeline, any attack path crossing that change is severed — and the investigation reaches the wrong conclusion that nothing happened.
Stable Identity
Identity is identity; attributes are attributes
Agent identity is decoupled from network attributes: the identity stays put, the attributes are recorded as time-stamped snapshots. Looking at history, you ask what this asset was called and which segment it sat in at the time — not the other way round.
| Item | How it is handled | Note |
|---|---|---|
| Agent identity | Long-lived, stored locally, reused after restart | The asset's single anchor on the timeline |
| Hostname / IP / NIC / MAC | Changes recorded as time-stamped snapshots | The value at any given moment can be queried |
| OS version and default route | Changes recorded as time-stamped snapshots | Used to judge what collection conditions applied |
| Registration and authorisation | The platform binds agent and organisation from the authentication context | A hostname or IP in the request is never the basis for authorisation |
| History after a reinstall | Never merged automatically | A candidate link is generated and established after admin review |
A stable agent identity keeps an asset continuous on the timeline. It does not identify a real person, and it does not replace your existing IAM or CMDB.
Candidate Links
After a rebuild, a person decides whether it is the same machine
The platform can propose that two records “may be the same asset”, but it does not decide for the administrator. One wrong automatic merge contaminates the historical evidence chain, and it is very hard to notice afterwards.
Collection Health
Knowing what was missed matters as much as what was collected
Collection state is first-class data, not a footnote in an operations console. It decides whether “no alerts” can be taken at face value.
| Monitored item | What is visible | What an anomaly means |
|---|---|---|
| Agent heartbeat and online state | Whether it is online and when it last reported | That endpoint is currently a blind spot |
| Collector state | Starting, running, failed, degraded, recovered | Coverage of the matching rule domain has dropped |
| Resource use | CPU, memory, disk and paging pressure | Safe degradation may be triggered |
| Reporting link | Local cache backlog, reporting delay, retry state | Events were collected but have not reached the platform |
| Clock drift | Difference between endpoint and platform time | Cross-host ordering needs human confirmation |
| Command timeout | An issued action did not reach a terminal state in time | The response outcome is not yet confirmed |
| Data gaps | Links where data is uncovered or missing | Conclusions for that window should keep their uncertainty |
The rule catalogue includes a dedicated domain that watches the health of collection itself. When collectors degrade, confidence in the other detection conclusions from that same window should be lowered with them, not read as if coverage were complete.
Safe Degradation
Built to stay on a production host for the long run
Security tools usually get uninstalled not because they were useless, but because one day they slowed the business down. So the checking mechanism is designed as “light by default, heavy work deferred”.
There are no publishable measured performance figures at present; we suggest confirming resource use and runtime impact by measurement in a pilot environment. After a restart the agent re-establishes the boundary of unfinished checks and keeps sending cached events.
What Comes Next
Related capabilities
The five capabilities share one body of evidence. Follow the investigation onward, or return to the overview.
Identity Threat & Lateral Movement Detection
Capability 01
Credential access, abnormal authentication, remote execution and host-side signals together judge one suspicious move.
View capabilityResponse & Audit
Capability 04
Issue, receive, execute and review each carry a visible state; high-risk actions are governed by approval and review.
View capabilityE-ITDR Product Overview
Product and deployment
Architecture, how the five capabilities divide the work, supported environments and boundaries.
Back to overviewExpert Consultation
Review collection coverage and data gaps
Tell us your endpoint scale and how often machines are virtualised or rebuilt, and we will explain how asset identity stays continuous and how collection gaps are shown:
Asset ledger today
How assets are identified now, and where it hurts
Coverage review
Which collectors are available under which conditions
Resource footprint
Degradation mechanism and pilot measurement
Scan with Feishu to consult