Overview of Exposure Analytics
concepts of Exposure Analytics
Exposure analytics brings fragmented security data together to provide a unified, risk-based view of your environment. It continuously discovers and maps active assets and users across cloud, hybrid, and on-premises environments, creating a dynamic inventory of entities and their relationships over time.
In addition to asset discovery, exposure analytics helps identify gaps in security controls, add context to risk, and prioritize remediation. Security analysts can investigate findings with a clearer view of the entities involved and focus on the threats that matter most. Security engineers can use the same context to address the exposures with the greatest potential impact.
By connecting discovery, risk context, investigation, and remediation, exposure analytics helps organizations shift from a reactive, alert-driven approach to a more proactive, risk-informed security strategy. This can help align security work with business priorities and support faster, more focused investigations and remediation.
Exposure Analytics includes the following core features:
| Feature | Description | Documentation |
|---|---|---|
|
Entity discovery |
Exposure Analytics continuously discovers entities from specific events in data already flowing into Splunk Enterprise Security. Views of the intelligence and analytics generated by Entity Discovery include
|
Dashboards described in the Splunk Enterprise Security User Guide |
|
Entity Posture |
Exposure Analytics uses entity posture metrics to identify security control gaps across discovered entities and visualize overall security posture. Views of the intelligence and analytics generated by Entity Posture include
You can also use metric data in Entity Profile rules and Entity Actions. |
Dashboards described in the Splunk Enterprise Security User Guide |
|
Entity Profile |
Exposure analytics enables the you to create entity profile rules, combining discovered entity exposures with contextual intelligence to identify and prioritize contextual risk and increase the risk level of associated findings Views of the intelligence and analytics generated by Entity Profile include:
|
Dashboard described in the Splunk Enterprise Security User Guide |
|
Entity Actions |
Exposure Analytics lets you define entity actions to prioritize, respond to, and help remediate security issues identified through posture metric gaps, entity profile rules, or any entity discovery filter. |