Entity profile insights

description of how to use entity profiles managed by your organization

The Entity profile insights dashboard provides a view into the contextual risk of your entities, based on the profile rules that have been created. Rules are typically based upon a mix of context and exposure to identify entities that have a higher contextual risk than others. For example, workstation entities used by executives (context) with missing security controls (exposure), might be assigned a profile level of High. Only entities that trigger one or more entity profile rules will have a profile level assigned. This profile level can also be used as a risk modifier for any findings that the entity may be associated with.

Profile insights are proactive, because the risk profile rule is based on the user, not on an attack happening to a certain asset.

For details on configuring entity profiles, see Configure entity profiles in the Administer Splunk Enterprise Security documentation.

Profile rules have the following levels, that can be used as risk factor modifiers, affecting the entity risk score (ERS).

  • Low

  • Medium

  • High

  • Critical

Profile rules also assign tags. Tags can be any value needed and multiple rules can share the same tag.

Entities that trigger one or more profile are assigned the tags from all rules and the highest rule level from all the triggered rules. For example, if an entity triggers 2 rules, one that assigns a rule level of low and another that assigns a rule level of high, the assigned profile level of the entity will be high. The entity might also have 2 tags, one from each of the triggered rules.

The profile level assigned to an entity can also be used as a risk factor to elevate the risk assigned to any subsequent findings associated with that entity. This helps to inject contextual risk into the risk calculation of a finding to help prioritize investigations and increase Entity Risk Scores (ERS).

For details on Entity Risk Scores (ERS), see Entity risk scoring in Splunk Enterprise Security in the Administer Splunk Enterprise Security documentation.

Under Insights, select the type of information you want to view:

  • Profile summary:

    Provides a current summary of asset or user entity counts by entity profile rule, level, and tags.

    Select or create a filter at the top of the page to show assets or users that match specific entity profile criteria or to select specific profile rules, levels, or tags.

    The rules table lists all rules that match the filter criteria along with the counts of assets or users that have triggered each rule. The assigned rule level and tag are displayed for each rule. Select a specific rule to drill down to the profile detail.

  • Profile detail:

    Provides a current tabular asset profile detail report, either by asset or user, displaying the number of triggered rules, along with the rules, profile tags, and profile level assigned to the entity.

    The profile level and profile tags assigned to the entity will be the highest rule level and aggregate of the tags from all the triggered rules. This will not change if the view is filtered by a specific rule.

    Select or create a filter at the top of the page to show assets or users that match specific entity profile criteria or to select specific profile rules, levels or tags.

    Select a specific asset or user entity to drill down to entity analysis for more detail about the entity.

  • Profile trends:

    Provides a historic trend of triggered entity profile rules over time.

    Select a filter at the top of the page to show assets or users that match specific entity profile criteria or to select specific profile rules, levels, or tags.

    The triggered profile rules table will show counts of entities that triggered each rule over the selected time range. Select a specific rule to filter the view by that rule.

    The triggered profile rules by asset or user will show the rules triggered over the selected time range for each specific entity, along with the last date each rule triggered for that entity.

    Select a specific asset or user entity to drill down to entity analysis for more detail about the entity.