Edit an entity posture metric

Basic editing steps

To edit an existing metric, complete the following steps:

Specify the metric fields

Specify the inventory fields to display on the Entity Posture dashboards and to make available for metric and exception logic. If required fields are not selected here, they cannot be used in that logic. When creating an additional metric, include any additional fields required by the metric or its exception logic.

To specify the fields used by a metric, complete the following steps:

1. Select Configure, then Exposure Analytics, then Entity Posture Management.

2. Select the pencil icon next to the metric you want to edit.

3. Select the Fields tab.

4. Make your field changes.

5. Select Save.

Modify the metric logic

Metric logic powers the metric calculations. Specify logic to determine which entities are in scope for the metric and which entities are considered gaps.

To specify the logic used by a metric, complete the following steps:

1. Select Configure then Exposure analytics, then Entity posture management.

2. Select the pencil icon next to the metric you want to edit.

3. Select the Logic tab.

4. In the In-scope section, complete the following information:

   1. Asset types: Specify the asset types for the metric. For example, if you want to create a metric only for workstation assets, select Workstation.

      Note: Asset types applies only to asset metrics.

   2. Last seen: The time period representing the last seen period for the entities in scope. This field uses Splunk relative time. For example, a value of -15d includes all entities last seen on the network in the past 15 days.

   3. Fields: If there are fields used in the Gaps section logic, specify them here.

   4. Additional logic: Further narrow down the scope of the metric using either search or where logic. For example, if you want to limit the metric to report on only Windows laptops, select search and enter os=windows* asset_class=laptop.

      Note: Do not use pipe ( | ) operators or complex Splunk SPL within additional logic.

5. In the Gaps section, set one or more gap conditions and reasons that will be used by the metric. Gap conditions use SPL case logic. Specify the gap condition using SPL and then provide a gap reason for that condition. Gap reasons are displayed on the Posture metric view.

   Most of the predefined metrics use similar logic and you can reuse this logic when creating additional metrics. The gap logic often refers to the lastseen times of specific entity discovery sources and these fields are represented in the format lastseen_source where source is the nickname of the entity discovery source and lastseen fields are epoch values.

6. Select Preview to view the logic results in a preview table. In the Gap column, 1 indicates that the asset is a gap, and 0 indicates that it is not. The gap_reason also displays for each gap.

7. Select Save.

Create or modify exceptions

Exceptions can be used for entities that are in-scope for a metric and should ordinarily be compliant with the metric, but there is some reason they cannot be. For example, there might be an endpoint security solution deployed that does not run on assets with a specific or legacy operating system. Making these assets exceptions does not excuse them from being in-scope but they will never be compliant as they cannot run the endpoint security solution.

Exceptions are clearly shown on the entity posture dashboards and an entity can be made an exception permanently or for only a period of time. Exceptions can be automatically added using logic, whenever they are discovered by Exposure analytics, or they can be manually added from the entity posture metric view on an adhoc basis as needed. A reason must be provided for the exception.

Automated exceptions

To specify the automated exception logic used by a metric, complete the following steps:

1. Select Configure, then Exposure Analytics, then Entity Posture Management.

2. Select the pencil icon next to the metric you want to edit.

3. Select the Exceptions tab.

4. Schedule: Enter the schedule in cron format for when the automated metric exception logic should run. This is typically once per day.

5. Fields: Specify these fields on the Fields tab. Any fields used in the exception logic must be specified.

6. Exception condition: Specify the exception condition using the available fields and SPL. Do not use pipe (|) operators.

7. Reason field: Provide a reason for the exception.

8. Exception expiry (optional): Select the toggle switch to turn on exception expiry. This option creates a temporary exception by designating the number of days until it expires. For example, enter 15 to remove the exception after 15 days.

9. Select Preview to see the logic results in a preview table. The exception_reason field is displayed in the table.

10. To run the exception logic on demand, select Generate exceptions (optional).

11. Select Save.

Manual exceptions

To add a metric exception from a particular metric dashboard, complete the following steps:

1. In Exposure Analytics, select Entity Posture Insights. Under Insights, select Posture Metric.

2. Under Metrics, select the metric that you want to add exceptions for.

3. In the Posture metric details table, filter the records as required by using the search box or toggling between Gaps and Compliant.

4. Select the check boxes for the entities you want to add as exceptions.

5. Select Add selected exceptions.

6. Enter an exception reason.

7. (Optional) Select the toggle switch to turn on exception expiry. This option creates a temporary exception by designating the number of days until it expires. For example, enter 15 to remove the exception after 15 days.

8. Select Add.

Select the Exceptions tab in the Posture metric details table to view or delete exceptions for a metric.