Methods, systems, and apparatus, including computer programs encoded on computer storage media, for uniquely identifying attacked assets. One method includes maintaining asset data mapping unique asset identifiers to non-unique asset identifiers and maintaining protection data mapping identifiers of sensors to unique identifiers of assets protected by the sensor. Attack data specifying attacks on particular assets is received. The unique identifier of each asset attacked is determined from the attack data, the protection data and the asset data.