Entity discovery overview

Exposure Analytics uses a patented process to discover entities on the network. It examines events in configured data sources and combines information from multiple systems of record to build a unified entity record.

Entity discovery does not ingest data sources into Splunk. Instead, it uses data that is already available in Splunk. Each configured entity discovery source is a search for events in a data source that contains asset-related information. Entity discovery uses a mix of different data sources to discover entities. Some data sources, such as Windows, DHCP, and VPN events, might stream into Splunk in near real time. Others, such as endpoint security and vulnerability data, might arrive in batches through scheduled API pulls. Events from these data sources can share common asset fields but might also have different fields. For example, DHCP events might include hostname, MAC address, and IP address, while an endpoint security source might also provide the operating system and version.

Every few minutes, the entity discovery processing searches over short time windows to process relevant events efficiently. It aggregates information from the configured sources, with each source contributing values for the fields it provides. When multiple sources provide a value for the same field, a prioritization process evaluates the values based on accuracy and timeliness. Enrichment rules, like company subnet information, can also help fill gaps in the entity record.

Entity discovery maintains inventories of assets and users, along with inventories for IP addresses and MAC addresses associated with them. It also retains a full discovery history; recording when an entity was discovered and how its details changed over time. This history supports security investigations and attribution - for example, identifying which user was associated with an asset and IP address at a specific point in time.

The discovery processing is designed to have a low-performance impact. While it runs every few minutes, it does so over short time windows. Current inventories are stored in KV stores, while historical discovery data is written to a summary index.

Each entity discovery processing run searches for asset-related events defined by the configured sources, then aggregates and normalizes the results. It retrieves previously discovered entity records, applies aggregation and prioritization, and uses enrichment rules and other logic to update field values. The resulting records are written to the inventories, and a summary is written to an index. A subset of the asset and user inventory data is also written to the Asset and Identity (A&I) lookups, which allows downstream Splunk Enterprise Security functions to leverage data discovered by Exposure analytics.