Networked device discovery and management

A method for networked device discovery, the method executed by a computing system, the method comprising:

• ingesting telemetry data of devices;
• obtaining relationship data which specifies one or more relationships between at least some of the devices and one or more physical facilities;
• extracting device identifications and device characteristics from the ingested telemetry data;
• constructing or updating an ontology graph, the ontology graph having device nodes, facility nodes, and edges, each edge between a device node and a facility node representing a relationship between a corresponding device and a physical facility, each edge between two device nodes representing a network communication between two corresponding devices, the facility node representing the physical facility itself as opposed to any of the following:
• a device, a device component, a network endpoint, a computing system hardware component, or a network component;
• and managing at least in part by use of artificial intelligence at least one of the devices based on the ontology graph, the managing comprising at least one of:
• creating in the digital memory an inventory manifest of the devices based on the telemetry data, visualizing on a computing system display a network topology, sending via the computing system a notification of an unknown device, sending via the computing system a notification of a previously inactive device that is active again, sending via the computing system a notification of a previously active device that is no longer active, or managing a security posture of a networked device by changing a configuration of the networked device or a configuration of another device, the managing also comprising calculating a risk rating or a security score by using a machine learning model with one or more of the following as inputs to the machine learning model:
• a value representing a misconfiguration, a value representing an omitted update, a value representing a vulnerability, a value representing an attack surface, a value representing a recent attack, or a value representing a physical security measure.

A computer-readable storage device configured with data and instructions which upon execution by a processor cause a computing system to perform a method for networked device discovery, the method comprising:

• ingesting telemetry data of devices;
• obtaining relationship data which specifies one or more relationships between at least some of the devices and one or more physical facilities;
• extracting device identifications and device characteristics from the ingested telemetry data;
• constructing or updating an ontology graph, the ontology graph having device nodes, facility nodes, and edges, each edge between a device node and a facility node representing a relationship between a corresponding device and a physical facility, each edge between two device nodes representing a network communication between the two corresponding devices, the facility node representing the physical facility itself as opposed to any of the following:
• a device, a device component, a network endpoint, a computing system hardware component, or a network component, the ontology graph including at least twenty device nodes which represent respective internet of things devices;
• and managing at least in part by use of artificial intelligence at least one of the devices based on the ontology graph, the managing comprising at least one of:
• creating in the digital memory an inventory manifest of the devices based on the telemetry data, visualizing on a computing system display a network topology, sending via the computing system a notification of an unknown device, sending via the computing system a notification of a previously inactive device that is active again, sending via the computing system a notification of a previously active device that is no longer active, or managing a security posture of a networked device by changing a configuration of the networked device or a configuration of another device, the managing also comprising calculating a risk rating or a security score by using a machine learning model with one or more of the following as inputs to the machine learning model:
• a value representing a misconfiguration, a value representing an omitted update, a value representing a vulnerability, a value representing an attack surface, a value representing a recent attack, or a value representing a physical security measure.