IdentityGraph™

What is IdentityGraph™?

Elisity IdentityGraph™ is the aggregated identity and behavior of every asset on your network, discovered natively by Elisity and enriched with identity and context from every connected system. It is the asset identity engine behind identity-based microsegmentation: the component that turns fragmented, partial, and often conflicting asset data into one reliable record per asset that policy can act on.

Most organizations already hold asset data in several places at once. An endpoint security platform knows the operating system and patch posture. A configuration management database knows the owner and the business function. A medical or industrial device platform knows the make, model, and clinical or operational role. An identity provider knows the last user who logged in. Each system holds part of the picture, each is maintained by a different team, and no two agree completely. Reconciling those sources by hand is not merely tedious — it is not achievable at the rate modern networks change, where new assets appear and new data becomes available continuously.

IdentityGraph™ automates that reconciliation. It discovers each asset from the network itself, queries every configured enrichment source for records that match, resolves disagreements between those sources according to a precedence order that you control, and presents the result as a single asset identity. Because classification is consolidated and traceable to its source, administrators can apply identity-based policy with confidence that the policy is matching the asset they intend.

How IdentityGraph™ Builds Asset Identity

IdentityGraph™ builds each asset record in three stages. The stages run continuously, so an asset record becomes more complete over time rather than being fixed at the moment of discovery.

Stage	What Happens
Discovery at the edge	Elisity identifies assets from the access layer you already operate, without agents, sensors, or network changes. Identifying data is drawn from sources such as DHCP, IP Device Tracking, RADIUS, and CDP/LLDP, collected through filtered ERSPAN and API integration with onboarded switches. Each discovered asset receives a record containing its network identifiers and the Virtual Edge Node that observed it.
Amplified identity	IdentityGraph™ queries every configured connector for records matching the discovered asset, typically on IP address, MAC address, or hostname. Attributes returned by each source are retained separately and attributed to that source, so the origin of every value remains visible.
Policy Group assignment	Where multiple sources report the same attribute with different values, IdentityGraph™ resolves the conflict using the connector precedence order you define, producing the Core Effective Attributes that serve as the asset's consolidated identity. Agreement between sources is measured and reported as a Consistency Score. Assets are then mapped to Policy Groups by evaluating that identity against match criteria, with no tagging or manual effort required.

Because discovery is agentless and driven by the switching infrastructure already in place, IdentityGraph™ records unmanaged and ephemeral assets that agent-based inventories miss — including devices that appear briefly, move between locations, or never accept software of their own.

The asset detail view brings all of this together. The following example shows a single workstation whose identity is assembled from Elisity's own discovery and four independent enrichment sources.

Where to Find IdentityGraph™ in Cloud Control Center

In Elisity Cloud Control Center (CCC), the IdentityGraph section provides a sortable, filterable inventory of every discovered asset and a per-asset detail view of everything IdentityGraph™ knows about it, including associated policy and observed traffic.

Location	Contents
IdentityGraph > Devices	The asset inventory. Enriched attributes appear as columns that you add, remove, sort, and filter, and the filtered view exports to CSV or XLSX for reporting. A Connectors column shows at a glance which enrichment sources hold a record for each asset.
IdentityGraph > Workloads	Discovered workloads, presented with the same inventory and detail behavior as devices.
IdentityGraph > Users	User identities correlated to assets from identity sources such as Active Directory.
IdentityGraph > Connectors	The configured enrichment sources, their connection state, and their synchronization activity.

The Connectors page lists every configured enrichment source together with its connection state and most recent synchronization.

To open the detail view for an asset, navigate to IdentityGraph > Devices and click the asset hostname. The Identity Graph tab of the detail view presents every attribute IdentityGraph™ holds, grouped by the category that produced it.

Attribute Categories in IdentityGraph™

Attributes are organized by origin. Understanding these categories is what allows an administrator to decide which attribute to match on when building policy, because the category indicates how the value was obtained and how much it can be relied upon.

Elisity Natively Discovered Attributes

These attributes derive from Elisity's own detection mechanisms and represent what Elisity establishes without external platforms or manual input. Examples include VLAN, subnet, interface, Virtual Edge Node association, and vendor derived from the MAC address. Native attributes are available as match criteria in Policy Group definitions and remain available whether or not any connector is configured.

For the full reference on natively discovered attributes and how each one behaves in policy, see Elisity Native Identity.

Manually Configured Attributes

Administrators set these attributes directly, and they take precedence over values obtained from automated sources. Manually configured values are the correct mechanism when an authoritative source is unavailable or when a business classification exists only in the administrator's knowledge. Device Labels are the most commonly used attribute in this category.

To create, organize, and assign labels, see Device Labels. To apply attributes across many assets at once, see Bulk Actions for Assets.

Connector Attributes

Every connector that returns data for an asset appears as its own card in the Identity Graph tab, displaying the attributes specific to that source. Retaining each source separately is deliberate: it preserves the individual perspective each platform holds on the asset, and it makes disagreement between sources visible rather than hidden behind a merged value.

Elisity supports connectors across identity providers, endpoint and IoT/IoMT security platforms, configuration management databases, and cloud platforms — including Microsoft Active Directory, Microsoft Entra ID, Microsoft Intune, Microsoft Defender for IoT, ServiceNow CMDB, CrowdStrike, SentinelOne, Claroty xDome, Claroty Medigate, Armis, Nozomi Networks, ORDR, Dragos, Asimily, Tenable One, NetBox Labs, Palo Alto Networks IoT Security, and 42Gears SureMDM. For configuration steps and the attributes each source contributes, see the Integrations category.

Where no pre-built connector exists, the Elisity Custom Connector and the Open Connector allow any system to contribute attributes to IdentityGraph™.

Each connector card also reports Matched on — the identifier used to tie the asset to that source's record, such as IP, MAC, or IP + MAC — and a Status value indicating whether that source's data is current.

Connector data refreshes on the schedule configured for each connector. To refresh a single source immediately, click the refresh control on that connector's card.

Trust Attributes

Trust Attributes record how well known and verifiable an asset's identity is across the systems Elisity queries. Rather than describing what an asset is, they describe how much corroboration exists for that claim.

The asset detail view presents them as a Known in list showing each source that holds a record for the asset, alongside a Not known in count for the configured sources that do not. An asset corroborated by several independent systems is a materially stronger candidate for a permissive policy than one no system recognizes.

Trust Attributes are exposed as a single match criterion under Core Effective Attributes, and are most effective alongside other criteria, where they raise the security posture applied to a subset of assets. An asset known in the configuration management database and the endpoint platform can receive a policy that an otherwise identical but unrecognized asset does not. For the full procedure, see Leveraging Trust Attributes for Policy Group Definition.

Core Effective Attributes

Core Effective Attributes are the consolidated identity of the asset — the values IdentityGraph™ selects as most accurate after evaluating every available source. The following attributes are available:

Attribute	Description
Hostname	The asset name, normalized for consistent formatting as match criteria.
FQDN	The fully qualified domain name, where discovered natively or through a connector.
Category	The standardized device classification. See Device Category and Consistency Score.
Class	The broad functional grouping of the asset.
Genre	The operational domain of the asset, such as IT or OT.
Type	The specific device type within its class.
Model	The manufacturer model designation.
Vendor	The manufacturer of the asset.
Operating System	The operating system reported for the asset.
MAC Address	The hardware address observed for the asset.
Label	Administrator-assigned Device Labels applied to the asset.
Site Label Tag	The Site Label tag associated with the asset's location.
Trust Attributes	The sources that hold a record for the asset. See Trust Attributes.

Because sources disagree, IdentityGraph™ resolves each attribute using a connector order of precedence that you establish. The winning source is displayed beside each value, so any classification can be traced to the system that reported it without leaving the page.

The effect is visible on a typical enriched workstation. Microsoft Intune and NetBox Labs both report the model as OptiPlex 7090, while the Core Effective value resolves to OptiPlex 5080 from the higher-ranked source. NetBox Labs classifies the same asset as Unclassified while every other source agrees it is a PC. Both disagreements remain visible on their originating connector cards rather than being discarded — which is precisely what makes the consolidated value auditable.

Core Effective Attributes are the primary match criteria for Policy Groups, but they are not the only option. Administrators retain visibility into every attribute collected for an asset and can match on native, connector-specific, or manually configured values instead.

Device Category and Consistency Score

Device Category provides a standardized classification for assets across the network, derived primarily from type and vendor data. Because the category vocabulary is fixed, it supports Policy Group definitions that remain stable as the underlying asset data changes. Categories include Audio Video, Building Management, Collaboration, Consumer Mobile, Industrial Automation, Medical Device, Miscellaneous IoT, Networking Equipment, PC, Physical Security System, Printer, Server Appliance and Storage, WiFi AP and Controller, and Unclassified.

Device Category is determined independently for each connector. ServiceNow, Medigate, and Armis each contribute their own category for the same asset, based on the attributes that source provides. Retaining these separately produces a measurable signal about agreement:

Consistency Score reflects how closely the category attributes from different sources align. When several connectors independently classify an asset as a medical device, the Consistency Score is high, and the assigned Device Category can be relied upon accordingly. A low score indicates that sources disagree and that the classification warrants review before policy depends on it.

Device Category appears throughout Cloud Control Center — in asset detail views, the Devices table, and exportable reports — and is available as a match criterion in policy configuration. This makes it practical to apply distinct policy to medical devices, industrial automation equipment, and traditional IT endpoints without enumerating individual assets.

Device Category Classification

Assets that cannot be categorized from connector data alone are evaluated by Elisity's classification models, which propose a category from evidence observed on the network. This process is designed to produce reviewable recommendations, not silent changes: every proposal is presented with the evidence that supports it, and an administrator decides whether to accept it.

For each unclassified asset that has generated network traffic, IdentityGraph™ evaluates two kinds of evidence:

Evidence Type	What It Reports
MAC Adjacency	Compares the asset's MAC address neighborhood against assets already classified. The evidence includes the Number of Similar Devices, the shared MAC Prefix, and the Average MAC Distance between the asset and its classified neighbors.
Traffic Pattern	Analyzes the asset's observed port and protocol behavior against known device categories. The evidence includes the matching port and protocol combinations and the observed traffic volume.

Each recommendation carries a Confidence Score from 0 to 100 indicating how strongly the supporting evidence backs the proposed category. Higher scores reflect stronger corroboration; lower scores warrant closer review before the recommendation is accepted.

Recommendations surface as device category Insights, labeled Category - MAC Adjacency or Category - Traffic Pattern according to the evidence present. Open the Insight Details dialog to review that evidence and accept or reject the proposed category. No category is applied, and no policy changes, until an administrator accepts the recommendation. For the complete review workflow, see Policy and Device Insights.

Last Seen and Last Update Attributes for Enrichment Sources

IdentityGraph™ records timestamps that describe how current an asset's identity data is. Distinguishing them matters when diagnosing a stale or unexpected attribute.

Attribute	Meaning
Last Seen	The most recent time the asset was detected. This value appears on the Elisity Native card and reflects the asset's last known presence.
Last Update	The most recent change to the enrichment data retrieved from a source. Each enrichment source carries its own Last Update value, so a single stale connector is identifiable without affecting the others.
Matched on	The identifier used to correlate the asset to that source's record, such as IP, MAC, or IP + MAC.
Status	Whether the data held for that source is current.

Read together, these values show whether an asset's attributes are current, whether a connector is successfully reaching the asset, and which identifier tied the asset to each system that contributes to its identity.

Enrichment Lookback Window

The Enrichment Lookback Window controls how recently an asset must have been online to receive connector enrichment. By default, connectors enrich only assets seen online within the past 72 hours. Configure this threshold per connector under IdentityGraph > Connectors > [Connector Name] > Edit > Advanced Settings.

For assets that are online infrequently — operational technology systems, remote equipment, or servers with intermittent connectivity — extend the window so they continue to receive enrichment even when they have not been seen recently. The valid range is 1 to 2,160 hours (1 hour to 90 days).

Shorter windows reduce enrichment attempts against inactive assets. Longer windows keep infrequently connected assets enriched with current attribute data. Choose the value that matches the connectivity profile of the assets a given connector serves.

Using IdentityGraph™ Attributes in Policy

Every attribute IdentityGraph™ collects is available as Policy Group match criteria. Navigate to Policy > Policy Groups, create a Policy Group, and open Matching Criteria Configuration. The criteria selector groups attributes by the source that produced them — Core Effective Attributes first, then a section for each configured connector — so the origin of a match criterion is clear at the point of use. As criteria are added, the wizard reports the number of matched assets before the Policy Group is saved.

Elisity supports four Policy Group types, which differ in the criteria they match on:

Policy Group Type	Matched Using
Dynamic	IdentityGraph™ attributes such as device type, vendor, operating system, or Trust Attributes.
Static	Manually assigned IP addresses and subnets.
Local	IdentityGraph™ attributes plus a Site Label, for localized classification.
Workload	IdentityGraph™ attributes drawn from cloud workload integrations.

This is what makes policy dynamic rather than static. A Policy Group defined on Device Category and Trust Attributes admits new assets automatically as they are discovered and enriched, and releases assets whose attributes no longer qualify. When an endpoint platform changes an asset's posture, or a configuration management database records a new owner, the asset's Policy Group membership follows without an administrator editing the policy.

IdentityGraph™ data is used across the platform in the following ways:

• Policy Groups: Define membership from enriched attributes rather than IP addresses or VLANs. See Policy Groups.
• Policy Matrix: Build policy between groups defined by asset identity.
• Traffic Analytics: Filter and analyze flows using enriched attributes for both source and destination.
• Reporting: Export the asset inventory with enriched attributes to CSV or XLSX for compliance and audit reporting.

Related Articles

• Elisity Native Identity — the complete reference for natively discovered attributes.
• Device Labels — creating, organizing, and assigning labels.
• Leveraging Trust Attributes for Policy Group Definition — applying Trust Attributes in policy.
• Policy and Device Insights — reviewing and accepting category recommendations.
• Bulk Actions for Assets — applying attributes across many assets.
• Integrations — configuration steps for every supported connector.