Add an entity action

You can manage entity actions in Exposure Analytics by adding actions and editing existing actions.

To add an entity action, first add an action condition. After adding the condition, you can add one or more alert actions to it.

To add an entity action condition, complete the following steps:

1. In Splunk Enterprise Security, select Configure, then Exposure Analytics, then open Entity actions management.

2. Select Add condition.

3. Select Asset or User for the category.

4. Enter a name for the condition.

5. Select a Condition type, such as an asset record, profile, or posture type.

6. Select a filter based on the condition type. For example, select a specific posture metric if you selected the posture condition type.

7. (Optional) Modify the schedule.

8. (Optional) Add or remove result fields as needed. Some types, such as posture, define which fields are available. To add new fields, edit the metric fields.

9. (Optional) Enter additional SPL logic to manipulate the result set or rename fields as needed.

10. Preview the condition output.

11. Select Save.

To add alert actions to an entity action condition, complete the following steps:

1. In the Entity actions management table, select the pencil icon next to the condition.

2. Select Add action.

3. Select an alert action from the list.

4. Configure the alert action for your organization.

5. Select Add action.

6. Add more actions, as needed.

7. Select Close when finished.

8. The configured actions are displayed in the table next to the entity action condition.

After you have added them, entity actions run according to their schedule, which defaults to once per day.