Exposure Analytics set up guide for admins
As a Splunk Enterprise Security admin, you can set up exposure analytics to continuously discover assets and users across your environment and enrich findings with contextual data. In addition, entity posture metrics identify gaps in your security controls, entity profile rules provide visibility into the entities with the highest contextual risk, and entity actions help address security issues or risks affecting your asset or users.
Exposure analytics empowers security analysts to prioritize and focus investigations, report on security control deficiencies, and proactively reduce the attack surface.
To begin, select Configure and then Exposure analytics in Splunk Enterprise Security. The first time you access the exposure analytics settings, you'll need to select Start set up to begin. The following table provides an overview of each key feature with its associated documentation link for configuration.
| Step | Feature | Setup task | Description | Documentation |
|---|---|---|---|---|
| 1 | Entity discovery | Configure entity discovery | Automatically detect data sources for discovery and pull data from specific events. You can select from predefined, compatible data sources, or add your own additional sources. | Configure entity discovery |
| 2 | Entity posture | Configure entity posture | Build security metrics to identify real-time security control gaps and visualize overall security posture. | Configure entity posture |
| 3 | Entity profile | Configure entity profile | Define entity profile rules that combine exposure data and contextual intelligence to assess contextual risk and prioritize remediation and security findings | Configure entity profile |
| 4 | Entity actions | Configure entity actions | Define entity actions to prioritize, respond to, and help remediate security exposures. | Configure entity actions |