Subject: [sacm] Data Collection Architecture and Collection Methods

From: "Wolfkiel, Joseph L CIV DISA ID (US)" <[email-masked]>
Date: Fri, 4 Sep 2015 17:26:24 +0000

After our talk this morning, I put together a simple diagram of how I see the data collector "space".  I would see the SACM focus as being primarily on how to get data from an endpoint back to a central aggregation point.

For getting the data from the endpoint, you can 1) expose a standard interface on the endpoint, 2) log directly into the endpoint, or 3) deploy an agent onto the endpoint that can provide inbound/outbound data communications.

On the endpoint itself, the SACM data collector can be expected to collect data using OS and application interfaces, log files or log file equivalents, and may also establish a local SACM data store, which may be used as a buffer for data to be transmitted during times when the device doesn't have network access and/or as a baseline to calculate differentials against.

The SACM aggregator can be expected to pull data from the endpoint, the agent, or the standardized interface, to receive data periodically pushed to it from the agent or the standardized interface, or to receive event-driven data updates from the agent or standardized interface.

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52
Work: (301) 225-8820
Gov Cell: (571) 814-8231
[email-masked]