Network asset correlator for cybersecurity operations

A non-transitory computer readable storage medium comprising program instructions executable to:

• receive a scanned dataset from a security server, wherein
• the scanned dataset comprises newly scanned node information that identifies one or more newly scanned nodes in a network;
• extract the newly scanned node information from the scanned dataset, wherein
• the newly scanned node information indicates that the one or more newly scanned nodes cannot be identified as being part of a plurality of existing computing devices in the network;
• process the newly scanned node information with a network access correlator, wherein
• the processing results in a set of asset correlation results for the one or more newly scanned nodes;
• identify an existing computing device of the plurality of computing devices based on a highest disparate correlation probability in the set of asset correlation results;
• and
• instruct the security server to perform a security action on the identified existing computing device.

A system comprising:

• one or more processors;
• and
• a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
• receive a scanned dataset from a security server, wherein
• the scanned dataset comprises newly scanned node information that identifies one or more newly scanned nodes in a network;
• extract the newly scanned node information from the scanned dataset, wherein
• the newly scanned node information indicates that the one or more newly scanned nodes cannot be identified as being part of a plurality of existing computing devices in the network;
• process the newly scanned node information with a network access correlator, wherein
• the processing results in a set of asset correlation results for the one or more newly scanned nodes;
• identify an existing computing device of the plurality of computing devices based on a highest disparate correlation probability in the set of asset correlation results;
• and
• instruct the security server to perform a security action on the identified existing computing device.