Internal IP Asset Profiling

The core question in internal IP asset profiling is: when an internal IP appears in an alert, how can you quickly identify what the asset is, which business owns it, and whether it has shown abnormal behavior recently?

Flocks builds a dedicated IP profiling Agent that queries devices and asset sources concurrently, aggregating CMDB, HIDS, NDR, firewall, and historical alerts. This capability supports two modes: quick query for summary enrichment during alert triage, and deep profiling for complete reports during incident investigation.

Scenario Overview

This scenario appears small in granularity, but it is an important capability for reducing false positives in real operations:

• Alerted IP is a dev/test machine -> Downgrade priority
• The IP in the alert is a core finance system -> escalate
• The IP has appeared in multiple recent alerts -> high priority
• The IP had similar behavior yesterday and was confirmed as a false positive -> archive directly

All of these judgments depend on IP profiling being quickly callable during triage. Making it an independent Agent or tool, instead of letting the main Agent assemble it ad hoc for every triage, improves stability, reuse, and later scheduled extension.

Inputs and Outputs

Typical Inputs

• Single internal IP, as the minimum unit
• A group of IPs, for batch profiling
• Optional: time window, defaulting to the last 24 hours

Typical Outputs

Two modes produce different outputs:

Mode	Response	Output
Quick query	Seconds	Structured summary: basic asset information + recent anomaly count + risk score
Deep profiling	Tens of seconds	Complete report: asset / business / behavior / alerts / risk score / handling recommendations

Prerequisites

Dependency	Requirement
Model	Default model is sufficient for quick query; reasoning models are recommended for deep profiling because summaries are more accurate
CMDB	Provides mappings among IP, hostname, department, owner, and business system
Multi-device integration	At least two of HIDS (processes / connections), NDR (traffic), and firewall (boundary logs) are integrated. See Internal Security Product Integration
Historical alerts	Recommended to persist alerts from a recent period or leave them in devices for trace-back
Business knowledge base	Optional. Used to add business context to profiles, such as "this is the payment gateway"

Steps (WebUI)

Step 1: Quick Query Mode

The most common use is embedding it in an alert triage session:

"Look up what machine 10.10.x.x is and whether it has had alerts in the last 24 hours."

The IP profiling Agent, or Rex directly calling the corresponding tool, will:

• Query CMDB / HIDS / NDR concurrently
• Merge and return "asset summary + alert count + risk score"
• Returns within seconds without generating a lengthy report.

Typical summary:

10.10.x.x
Asset: host-xxx-prod, Finance System A, owner: Zhang San
Last 24h alerts: NDR 3 / HIDS 1 / firewall 0
Abnormal behavior: lateral scan x1 (09:12)
Risk score: medium-high (2 medium-risk alerts unresolved)

Step 2: Deep Profiling Mode When Quick Query Is Not Enough

If alert triage or cross-device investigation finds the IP suspicious, explicitly switch to deep mode:

"Create a complete asset profile report for 10.10.x.x."

The Agent additionally:

• Pulls historical alerts and network behavior over a longer time window, such as 7 days / 30 days
• Identifies abnormal patterns: high-frequency outbound connections, lateral movement, off-hours activity
• Generates a risk score with weighted dimensions
• Recommends actions: whether to start host forensics, expand investigation, or temporarily block

The full report is persisted to Workspace, such as profiles/10.10.x.x.md, and is highly reusable.

Step 3: Batch Profiling for Incident Expansion

A common cross-device investigation scenario: after a compromised host is found, determine whether neighbors in the same subnet are also abnormal.

"For each internal IP in 10.10.x.0/24 that has had alerts recently, draw a quick profile and highlight problematic ones."

The Agent:

• First filters the device data for IPs with alerts in the last 24 hours, avoiding full scanning
• Calls quick profiling for each IP
• Summarizes into a table and highlights high-risk entries

Step 4: Optional: Capture as a Skill and Tool

If profiling rules have stabilized within the enterprise, such as the risk scoring algorithm or business classification logic, capture them into Skills:

• Every call uses the same rules and produces comparable outputs
• Algorithm changes happen in one place
• Newly added Agents or Workflow can reuse them automatically

Real Case Walkthrough: Quick Expansion During Alert Triage

Stage	Rex / IP profiling Agent action	Output / notes
Starting point	Alert triage stage: NDR reports 10.10.x.x scanning 10.10.y.y internally	Need to know what both IPs are
Concurrency	Rex calls the IP profiling tool for both IPs at the same time	Concurrent, not serial
Source IP profile	10.10.x.x = operations bastion host, owner: operations group	It normally initiates internal connections
Target IP profile	10.10.y.y = finance database, not a normal access target for the bastion host	Anomaly signal
Linkage	Rex judges that "bastion host -> finance database" should not occur under this enterprise policy and escalates the alert to high priority	The triage loop now has business semantics
Archive	Both profiles are written to Workspace and referenced in the alert triage report	Complete evidence chain

Output Example (Deep Profile)

# 10.10.x.x Deep Profile Report

## Asset Basics
- Hostname: host-fin-db-01
- Owner department: Finance Center
- Owner: Zhang San / Li Si (backup)
- Business system: Core Accounting A
- Launch date: 2025-11-12

## Network Behavior (Last 7 Days)
- Average connections: 320/hour
- Top outbound targets: 10.10.a.b (OLAP sync), 10.10.c.d (backup)
- Abnormal outbound connections: 2 (including 1 attempted external DNS access, blocked at the perimeter)

## Historical Alerts (Last 30 Days)
| Date | Source | Type | Conclusion |
| --- | --- | --- | --- |
| 03-12 | HIDS | Abnormal login | Legitimate operations change (confirmed) |
| 03-25 | NDR | Suspicious outbound connection | Missed-report optimization configuration, not a real threat |
| 03-28 | NDR | Internal scan | Pending triage in this run |

## Risk Score
- Asset criticality: high (core business)
- Recent anomaly density: medium (3 cases / 30 days)
- Overall risk: high (pending triage)

## Recommendations
- Upgrade this alert to P1
- Delegate the host forensics Agent to 10.10.x.x
- If there is no progress within 2 hours, temporarily restrict outbound internet access

Continuous Operation and Scheduled Tasks

Task form	Description
Daily profiling for high-value assets	Run deep profiling for the core asset list every day and automatically push abnormal changes to IM
Alert-linked quick lookup	"Look up this IP" during alert triage defaults to quick profiling and returns in seconds
Compromise-scope monitoring	Confirmed compromised assets are automatically added to a "high-frequency profiling" list and checked hourly
Weekly inventory recalculation	Recalculate risk scores every week based on CMDB sync + alerts from the last 7 days for attack surface management

Boundaries and FAQ

Question	Handling
CMDB coverage is incomplete, and many IPs have no owner	Connect an "asset discovery enrichment" flow in the profiling Agent; when ownership is unknown, still return "unknown owner + behavior summary"
Batch profiling is slow	Add concurrency limits and slicing; add a cache Skill for sources with large historical data
Risk score criteria are inconsistent	Define them once in a Skill and reuse everywhere
Want profiling to cover internet assets	Use Internet Asset Discovery; profiling logic is different because the perspective is external and multi-source discovery-based
Personal information is involved	Owner fields can be desensitized in channel notifications and retained only in raw Workspace reports. See Data and Desensitization

---

Related Resources: Scenario Overview · Alert Triage · Cross-device Deep Investigation · Internet Asset Discovery · Tool List · Skills