Add asset and identity data to Splunk Enterprise Security

Splunk Enterprise Security uses an asset and identity system to correlate asset and identity information with events to enrich and provide context to your data. This system takes information from entity discovery within Exposure Analytics or external data sources to populate lookups, which Enterprise Security correlates with events at search time.

When you have configured entity discovery within exposure analytics, these asset and identity lookups are populated automatically, removing the need to to populate them through other methods.

Use the Asset and Identity Management page to enrich and manage asset and identity data using lookups. Ensure you have the edit_modinput_identity_manager capability assigned to your user role to access this feature. See Configure users and roles in the Installation and Upgrade Manual.

When the identity manager runs, it processes all of the asset and identity input configuration.

The SPL search uses a custom search command that handles the merging and updating of new data to existing data. The custom search command merges data based on key fields and policies that you define here.

Assets and identities that need to be deleted are updated in the KV store with a _delete flag set to True so that the delete operation can persist and be completed at a later time.

The custom search command returns the merged data, which is updated or inserted to the KV store using outputlookup append=T. The identity manager checks and processes rows that are marked for deletion.

You have choices for registering asset and identity data in ES:

Automatically register asset and identity data using entity discovery within Exposure Analytics

how to register asset and identity data automatically

This method is enabled by default, after you have configured entity discovery in Exposure Analytics. In most cases, this method is preferred over other methods of registering asset and identity data.

Do the following to automatically populate asset and identity lookups to take advantage of asset and identity correlation.

  1. If you have not already done so, configure entity discovery in Exposure Analytics. For details, see Configuring entity discovery sources for Exposure Analytics.

  2. Populate Splunk Enterprise Security asset and identity lookups with entity discovery data. For details, see Populate Splunk ES Asset and Identity (A&I) lookups with entity discovery data

Use LDAP to register data in Asset and Identity Manager

Do the following to use LDAP to register asset and identity data in ES to take advantage of asset and identity correlation.

  1. Collect and extract asset and identity data in Splunk Enterprise Security.
  2. Create an asset lookup from your current LDAP data in Splunk Enterprise Security.
  3. Create an identity lookup from your current LDAP data in Splunk Enterprise Security.
  4. Verify that your asset or identity data was added to Splunk Enterprise Security.

Use your cloud service provider to register data in Asset and Identity Manager

Do the following to use your cloud service provider to register asset and identity data in ES to take advantage of asset and identity correlation.

  1. Create an asset lookup from your current cloud service provider data in Splunk Enterprise Security.
  2. Create an identity lookup from your current cloud service provider data in Splunk Enterprise Security.
  3. Verify that your asset or identity data was added to Splunk Enterprise Security.