Various exemplary embodiments relate to a method and related network node including one or more of the following: receiving, at the network device, a message associated with an entity; determining that the message lacks at least one primary identification value used to identify the entity associated with the message; extracting at least one secondary identification value from the message; selecting a correlation rule of a plurality of correlation rules that matches the at least one secondary identification value, wherein each correlation rule of the plurality of correlation rules identifies a mapping between secondary identification values and primary identification values; identifying the at least one primary identification value based on the selected correlation; identifying the entity based on the at least one primary identification value.