The data model in Tideway Foundation is unique in the way it allows the data produced by Foundation to be represented in a consistent and understandable manner.

The data model stores different types of related data in separate areas of the model. This allows a high degree of clarity in what a particular piece of information represents and where it came from.

The main types of data represented in the model are:

• Directly Discovered Data
• Knowledge Information
• Inferred Information
• Provenance Information
  For more information about the Tideway Foundation data model see the Tideway Foundation Node Lifecycle Document

Directly Discovered Data

Directly Discovered Data is data that the Discovery Engine has discovered; it has not undergone any processing beyond simple parsing. Everything that the Discovery Engine finds that may be of interest is stored, regardless of whether it is understood or not. It is stored in a structured form that can be queried and reported on, making it easy to construct certain kinds of discovery reports, and aids in developing new patterns.

Network connections and listening ports are stored as nodes and related through DiscoveredList nodes to the respective DiscoveryAccess node. Patterns take the raw discovery data and use it to relate nodes together and add it to the model of the environment.

Directly discovered information is the information that is obtained directly from a target host via particular discovery techniques. Examples of directly discovered information includes items such as the kind of processor in a host, the amount of RAM it has, its running processes, its network connections and so on.

Discovery information is aged and removed over time. Tideway Foundation supports a simple aging strategy that removes all information on discovery accesses that are older than a certain age, and the associated directly discovered data nodes.

Knowledge Information

Knowledge Data is supplied through Tideway Knowledge Updates and includes static information about products, publishers and so on.
Knowledge information is information about hardware, applications and software products and their versions, and is included in the patterns supplied with Tideway Foundation and Tideway Knowledge Updates.

Inferred Information

Inferred information is information that is reasoned from directly discovered data, and it is this information which will be of primary interest to most users. These include items such as Hosts, Subnets, SIs (Software Instances), and BAIs (Business Application Instances). Switches are not inferred, they are imported.

The inference of any type of node can be controlled by the user by writing patterns which are run by the reasoning engine. It includes classifications of discovered processes, groupings of discovered information into running instances of products, and so on.

A Host node is not considered directly discovered information, since a level of inference is required to decide which Host a discovered endpoint corresponds to, and whether it corresponds to a host at all.

Provenance Information

By linking data items and their attributes to the evidence for them, Foundation enables its data to be easily verified; a prerequisite for trusting it. This feature is called "Provenance".
Provenance Data is created by the Reasoning Engine and consists of relationships between Directly Discovered Data items and entities inferred from them – a relationship back to the source from the inferred entity. For example, there is a provenance relationship between each Software Instance (SI) and the data that caused the SI to be inferred – typically one or more processes, files, or the like.
Provenance information is meta-information describing how the other information came to exist. It is generated as Reasoning builds and maintains the model. Provenance information is stored as relationships in the model.

• Inference types
  • Primary – indicates that the existence of the evidence node is the reason that the inferred node was created.
  • Contributor – indicates that the evidence node provided information used in building the inferred node.
  • Associate – indicates that we know there is a relationship between the evidence node and the inferred node.
  • Relationship – indicates that we know a relationship exists because of the evidence node.
  • Deletion – indicates that the removal of the inferred node was due to withdrawal of the evidence node.
• Maintaining pattern – the pattern maintaining a Software Instance.

Example software instance provenance information is shown below.

Relationship Data Provenance

When a relationship is established, an inference to that relationship can be created to indicate the reason this relationship was originally made. This relationship data provenance can be viewed when you click the Show Provenance button. Clicking the Show Provenance button enables the provenance view on every page where it is available.

For example, in the data model this can be seen with the relationship between a Subnet and Network Interface.