Device identification based on event logs

A computer-implemented method of validating an identifier of an operating environment of a computing device, comprising:

• initiating a validation request for a policy-related record associated with an externally controlled policy enforced by an agent application in the computing device;
• in response to the validation request, retrieving, via the agent application running on the computing device, an events profile associated with an original event-based ID bound by the agent application to the policy-related record;
• deriving, in real-time, a dynamic event-based ID based at least partly on a first event property in a first event log as identified in the events profile, the first event log being a log maintained by an operating system of the computing device or an application running on the operating system;
• wherein deriving includes:
• extracting event properties from event logs in the operating environment of the computing device, the event properties indicated in the events profile;
• and
• generating a hash value based on the extracted event properties to be part of the dynamic event-based ID;
• comparing the dynamic event-based ID against the original event-based ID;
• and
• determining whether to validate the policy-related record based on whether the dynamic event-based ID matches the original event-based ID.

A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a processor, are configured to implement a computer-implemented process, the computer-implemented process comprising:

• identifying a choice pool of candidate event logs in an operating environment of the computing device;
• receiving an ID generation request to generate an identifier of the operating environment to bind to a policy-related record associated with an externally controlled policy enforced through an agent application;
• in response to receiving the ID generation request, generating an events profile and a profile ID associated with the events profile, wherein generating the events profile includes selecting a first event log from the choice pool and selecting a first event property from the first event log;
• generating an event-based device ID based at least partly on the selected first event property extracted from the first event log according to the events profile, the event-based device ID including a reference to the profile ID of the events profile, wherein the event-based device ID serves as the identifier of the operating environment;
• wherein generating the event-based device ID includes hashing the event properties into a hash value to be part of the event-based device ID;
• and
• storing the policy-related record that is bound to the event-based device ID.