Entity analysis
The Entity analysis dashboard is a centralized security operations interface in Splunk Enterprise Security that consolidates asset and user analysis, attribution, exposures and anomaly discovery into a single, unified workflow. Security analysts can move fluidly between analyzing individual assets and users and reviewing attribution patterns.
The dashboard draws on aggregated data from different enterprise security features, including exposure analytics, findings, risk, UEBA, and asset and identity, to display a continuously updated view of every asset and user on your network. From this shared data foundation, the dashboard surfaces both targeted details and broad attribution signals. The dashboard provides the following core capabilities:
The information displayed for an entity depends on whether entity discovery in exposure analytics has been configured or not.
Entities discovered by Exposure Analytics display the full set of fields, along with Attributions, Subnets, Findings, Exposures, and Attack surface tabs.
Entities found only in Asset and Identity lookups (and not in Entity discovery) display a very limited set of fields and tabs only. The Attributions, Subnets, Exposures, and Attack surface tabs are not available for these entities.
The dashboard provides the following core capabilities:
-
Analyze individual assets and users using multi-tab views of attributions, findings, exposures, and entity attack surface.
-
Examine subnet discovery context for IP addresses.
-
Quickly attribute IP addresses and findings to specific assets and users at any point in time.
-
Understand how the entity has changed over time, such as IP history and OS upgrades.
-
Understand exposures affecting the asset or user, including security control gaps and contextual risk.
-
Visualize asset relationships and attack surface exposure through an interactive graph explorer.
-
Surface anomalous behavioral patterns, including dormant asset reactivation, short-lived assets, and credential anomalies.